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Abstract. Modern large-scale distributed systems often rely on eventually con- 
sistent replicated stores, which achieve scalability in exchange for providing weak 
semantic guarantees. To compensate for this weakness, researchers have pro- 
posed various abstractions for programming on eventual consistency, such as 
replicated data types for resolving conflicting updates at different replicas and 
weak forms of transactions for maintaining relationships among objects. How- 
ever, the subtle semantics of these abstractions makes using them correctly far 
from trivial. 

To address this challenge, we propose composite replicated data types, which for- 
malise a common way of organising applications on top of eventually consistent 
stores. Similarly to a class or an abstract data type, a composite data type en- 
capsulates objects of replicated data types and operations used to access them, 
implemented using transactions. We develop a method for reasoning about pro- 
grams with composite data types that reflects their modularity: the method allows 
abstracting away the internals of composite data type implementations when rea- 
soning about their clients. We express the method as a denotational semantics for 
a programming language with composite data types. We demonstrate the effec- 
tiveness of our semantics by applying it to verify subtle data type examples and 
prove that it is sound and complete with respect to a standard non-compositional 
semantics. 

1 Introduction 

Background. To achieve availability and scalability, many modern networked sys- 
tems use replicated stores, which maintain multiple replicas of shared data. Clients can 
access the data at any of the replicas, and these replicas communicate changes to each 
other using message passing. For example, large-scale Internet services use data replicas 
in geographically distinct locations, and applications for mobile devices keep replicas 
locally as well as in the cloud to support offline use. Ideally, we would like replicated 
stores to provide strong consistency, i.e., to behave as if a single centralised replica 
handles all operations. However, achieving this ideal usually requires synchronisation 
among replicas, which slows down the store and even makes it unavailable if network 
connections between replicas fail [13, 2]. For this reason, modern replicated stores often 
provide weaker guarantees, described by the umbrella term of eventual consistency [4]. 

Eventually consistent stores adopt an architecture where a replica performs an oper- 
ation requested by a client locally without any synchronisation with others and imme- 
diately returns to the client; the effects of the operation are propagated to other replicas 
only eventually. As a result, different replicas may find out about an operation at differ- 
ent points in time. This leads to anomalies, one of which is illustrated by the outcome 



Fig. 1. Anomalies illustrating the semantics of causal consistency and causally consistent trans- 
actions. The outcomes of operations are shown in comments. The variables v and w are local to 
clients. The structures shown on the right are explained in §3.2. 

(a) Disallowed 
Rl: friends[a].add(b) 
wall[a].a.dd(post) 



R2: v = wall[a] .get // {post} 
w — friends [a], get // 0 



of a .add(6) 
sol 

m m -&dd(post) 



eowa-get: {post} 

' -i 

eofa.get: 0 



(b) Allowed, even when using transactions 
Rl: wall[a].a.dd(postl ) 
v = wall[b].get // 0 



R2: wall[b].add{post2) 
w — wall[a\. get // 0 



(Owi.&dd(postI) (Owb.add(post2) 
owb.get: 0 « W a.get: 0 



(c) Disallowed 

Rl: atomic { 

friends [a], add (b) 
friends[b].add(a) } 



R2: atomic { 

v — friends [a] .get // {&} 
w = friends [b]. get // 0 } 



r/'j.addl/'l- 
ft)fb.add(a) 



►rafa.get: {&}: 
(ofb.get: 0 j 



in Figure 1(a). The program shown there consists of two clients operating on set ob- 
jects friends[a] and wall[a], which represent information about a user a in a social 
network application. The first client, connected to replica 1, makes b a friend of a's 
and then posts fo's message on a's wall. After each of these operations, replica 1 might 
send a message with an update to replica 2. If the messages carrying the additions of b 
to friends[a] and post to wall[a] arrive at replica 2 out of order, the second client can 
see 6's post, but does not know that b has become a's friend. This outcome cannot be 
produced by any interleaving of the operations shown in Figure 1(a) and, hence, is not 
strongly consistent. 

The consistency model of a replicated store restricts the anomalies that it exhibits. 
In this paper, we consider the popular model of causal consistency [17], a variant of 
eventual consistency that strikes a reasonable balance between programmability and 
efficiency. A causally consistent store disallows the anomaly in Figure 1(a), because it 
respects causal dependencies between operations: if the programmer sees fe's post to a's 
wall, she is also guaranteed to see all events that led to this posting, such as the addition 
of b to the set of a's friends. Causal consistency is weaker than strong consistency; in 
particular, it allows reading stale data. This is illustrated by the outcome in Figure 1(b), 
which cannot be produced by any interleaving of the operations shown. In a causally 
consistent store it may be produced because each message about an addition sent by the 
replica performing it may be slow to get to the other replica. 

Due to such subtle semantics, writing correct applications on top of eventually con- 
sistent stores is very difficult. In fact, finding a good programming model for eventual 
consistency is considered one of the major research challenges in the systems commu- 
nity [4]. We build on two programming abstractions proposed by researchers to address 
this challenge, which we now describe. 

One difficulty of programming for eventually consistent stores is that their clients 
can concurrently issue conflicting operations on the same data item at different replicas. 
For example, spouses sharing a shopping cart in an online store can add and concur- 



rently remove the same item. To deal with these situations, eventually consistent stores 
provide replicated data types [22] that implement objects, such as registers, counters 
or sets, with various strategies for resolving conflicting updates to them. The strategies 
can be as simple as establishing a total order on all operations using timestamps and 
letting the last writer win, but can also be much more subtle. For example, a set data 
type, which can be used to implement a shopping cart, can process concurrent oper- 
ations trying to add and concurrently remove the same element so that ultimately the 
element ends up in the set. 

Another programming abstraction that eventually consistent stores are starting to 
provide is transactions, which make it easier to maintain relationships among different 
objects. In this paper we focus on causally consistent transactions, implemented (with 
slight variations) by a number of stores [25, 17, 18, 23, 16, 1, 3]. When a causally con- 
sistent transaction performs several updates at a replica, we are guaranteed that these 
will be delivered to every other replica together. For example, consider the execution 
in Figure 1(c), where at replica 1 two users befriend each other by adding their iden- 
tifiers to set objects in the array friends. If we did not use transactions, the outcome 
shown would be allowed by causal consistency, as replica 2 might receive the addition 
of b to friends[a], but not that of a to friends[b}. This would break the expected invari- 
ant that the friendship relation encoded by friends is symmetric. Causally consistent 
transactions disallow this anomaly, but nevertheless provide weaker guarantees than 
the classical serialisable ACID transactions. The latter guarantee that operations done 
within a transaction can be viewed as taking effect instantaneously at all replicas. With 
causally consistent transactions, even though each separate replica sees updates done by 
a transaction together, different replicas may see them at different times. For example, 
the outcome in Figure 1(b) could occur even if we executed the pair of commands at 
each replica in a transaction, again because of delays in message delivery. 

A typical way of using replicated data types and transactions for writing applications 
on top of an eventually consistent store is to keep the application data as a set of objects 
of replicated data types, and update them using transactions over these objects [25, 23, 
16, 1]. Then replicated data types ensure sensible conflict resolution, and transactions 
ensure the maintenance of relationships among objects. However, due to the subtle se- 
mantics of these abstractions, reasoning about the behaviour of applications organised 
in this way is far from trivial. For example, it is often difficult to trace how the choice 
of conflict-resolution policies on separate objects affects the policy for the whole appli- 
cation: as we show in §5, a wrong choice can lead to violations of integrity invariants 
across objects, resulting in undesirable behaviour. 

Contributions. To address this challenge, we propose a new programming concept 
of a composite replicated data type that formalises the above way of organising appli- 
cations using eventually consistent stores. Similarly to a class or an abstract data type, a 
composite replicated data type encapsulates constituent objects of replicated data types 
and composite operations used to access them, each implemented using a transaction. 
For example, a composite data type representing the friendship relation in a social net- 
work may consist of a number of set objects storing the friends of each user, with 
transactions used to keep the relation symmetric. Composite data types can also capture 



the modular structure of applications, since we can construct complex data types from 
simpler ones in a nested fashion. 

We further propose a method for reasoning about programs with composite data 
types that reflects their modularity: the method allows one to abstract from the internals 
of composite data type implementations when reasoning about the clients of these data 
types. Technically, we express our reasoning method as a denotational semantics for a 
programming language that allows defining composite data types (§4). As any denota- 
tional semantics, ours is compositional and is thus able to give a denotation to every 
composite data type separately. This denotation abstracts from the internal data type 
structure using what we term granularity abstraction: it does not record fine-grained 
events describing operations on the constituent objects that are performed by compos- 
ite operations, but represents every invocation of a composite operation by a single 
coarse-grained event. Thereby, the denotation allows us to pretend that the compos- 
ite data type represents a single monolithic object, no different from an object of a 
primitive data type implemented natively by the store. The denotation then describes 
the data type behaviour using a mechanism recently proposed for specifying primitive 
replicated data types [10]. The granularity abstraction achieved by this coarse-grained 
denotational semantics is similar (but not identical, as we discuss in §7) to atomicity 
abstraction, which has been extensively investigated in the context of shared-memory 
concurrency [12, 24]. 

Our coarse-grained semantics enables modular reasoning about programs with com- 
posite replicated data types. Namely, it allows us to prove a property of a program by: ( ij 
computing the denotations of the composite data types used in it; and ( ii) proving that 
the program satisfies the property assuming that it uses primitive replicated data types 
with the specifications equal to the denotations of the composite ones. We thus never 
have to reason about composite data type implementations and their clients together. 

Since we use an existing specification mechanism [10] to represent a composite 
data type denotation, our technical contribution lies in identifying which specification 
to pick. We show that the choice we make is correct by proving that our coarse-grained 
semantics is sound with respect to a fine-grained semantics of the programming lan- 
guage (§6), which records the internal execution of composite operations and follows 
the standard way of defining language semantics on weak consistency models [10,6]. 
We also establish that the coarse-grained semantics is complete with respect to the fine- 
grained one: we do not lose precision by reasoning with denotations of composite data 
types instead of their implementations. The soundness and completeness results also 
imply that our coarse-grained denotational semantics is adequate, i.e., can be used for 
proving the observational equivalence of two composite data type implementations. 

We demonstrate the usefulness of the coarse-grained semantics by applying the 
composite data type denotation it defines to specify and verify small but subtle data 
types, such as a social graph (§5). In particular, we show how our semantics lets one 
understand the consequences of different design decisions in the implementation of a 
composite data type on its behaviour. 

Technical challenges. Coming up with a composite data type denotation that would 
be sound and complete with respect to the standard fine-grained semantics is far from 
straightforward. The reason is that the semantics of causally consistent transactions is 



inherently non-compositional, as is common for weak consistency models. It is de- 
fined by so-called consistency axioms — global constraints on certain structures over 
events and relations that represent all events occurring in a store execution [11, 10,9] 
(§3). Then proving the soundness of our coarse-grained semantics requires us to show 
that an execution in the fine-grained semantics can be transformed by collapsing fine- 
grained events inside each composite operation into a single coarse-grained event while 
preserving the validity of the consistency axioms. This is delicate: e.g., merging two 
vertices in a DAG can create a cycle. Our main contribution is to craft the denotation 
of a composite data type so that such problems do not arise. The subtle semantics of 
causally consistent transactions also makes the proofs of soundness and completeness 
of the resulting denotational semantics highly nontrivial. 

2 Programming language and composite replicated data types 

Store data model. We consider a replicated store organised as a collection of prim- 
itive objects. Clients interact with the store by invoking operations on objects from 
a set Op, ranged over by o. Every object in the store belongs to one of the primitive 
replicated data types B € PrimType, implemented by the store natively. The signature 
sig(-B) C Op determines the set of operations allowed on objects of the type B. As 
we explain in §3, the data type also determines the semantics of the operations and, 
in particular, the conflict-resolution policies implemented by them. For uniformity of 
definitions, we assume that each operation takes a single parameter and returns a single 
value from a set of values Val, whose elements are ranged over by a, b, c, d. We assume 
that Val includes at least Booleans and integers, their sets and tuples thereof. We use a 
special value _L e Val to model operations that take no parameter or return no value. For 
example, primitive data types can include sets with operations add, remove, contains 
and get (the latter returning the set contents). 

Composite replicated data types. We develop our results for a language of client 
programs interacting with the replicated store, whose syntax we show in Figure 2. We 
consider only programs well-typed according to the rules also shown in the figure. 
The interface to the store provided by the language is typical of existing implemen- 
tations [25, 1]. It allows programs to declare objects of primitive replicated data types, 
residing in the store, invoke operations on them, and combine these into transactions. 
Crucially, the language also allows declaring composite replicated data types from the 
given primitive ones and composite objects of these types. These composite objects 
do not actually reside in the store, but serve as client-side anchors for compositions of 
primitive objects. A declaration D of a composite data type includes several constituent 
objects of specified types Tj, which can be primitive types, composite data type decla- 
rations or data-type variables a € DVar, bound to either. The constituent objects are 
bound to distinct object variables Xj, j = l..m from a set OVar. The declaration D 
also defines a set of composite operations O (the type's signature), with each o e O 
implemented by a command C Q executed as a transaction accessing the objects Xj. We 
emphasise the use of transactions by wrapping C 0 into an atomic block. Since a store 
implementation executes a transaction at a replica without synchronising with other 
replicas, transactions never abort. 



Fig. 2. Programming language and sample typing rules. 
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The syntax of commands includes the form var t>. C for declaring ordinary vari- 
ables v, w e Var, to be used by C, which store values from Val and are initialised to 
_L. Commands C 0 in composite data type declarations D can additionally access two 
distinguished ordinary variables v m and v out (never declared explicitly), used to pass 
parameters and return values of operations: the parameter gets assigned to v- m at the 
beginning of the execution of C a and the return value is read from w out at the end. The 
command v = x.o(G) executes the operation o on the object bound to the variable x 
with parameter G and assigns the result to v. 1 

Our type system enforces that commands only invoke operations on objects consis- 
tent with the signatures of their types and that all variables be used within the correct 
scope; in particular, constituent objects of composite types can only be accessed by their 
composite operations. For simplicity, we do not adopt a similar type discipline for val- 
ues and treat all expressions as untyped. Finally, for convenience of future definitions, 
the typing rule for v — x.o(G) requires that v m and v out do not appear in v or G. 

Example: social graph. Figure 3 gives our running example of a composite data 
type soc, which maintains friendship relationships and requests between accounts in 
a toy social network application. To concentrate on core issues of composite data type 
correctness, we consider a language that does not allow creating unboundedly many 
objects; hence, we assume a fixed number of accounts N. Using syntactic sugar, the 

1 Since the object bound to x may itself be composite, this may result in atomic blocks being 
nested. Their semantics is the same as the one obtained by discarding all blocks except the 
top-level one. In particular, the atomic blocks that we include into the syntax of commands 
have no effect inside operations of composite data types. 



Fig. 3. A social graph data type soc. 



D soc = let { friends — new RWset[JV]; requesters = new RWset[iV] } in { 
request(/rom, to) = atomic { 

if (friends [to], contains (from) V requesters[to].conta.ins(from)) then v out — false 

else { requester s[to\.add(from); v ou t = true } }; 
accept(/rom, to) = atomic { 

if (-irequesters[to].conta.±ns(from)) then v ou t = false 

else { requesters[to].remove(from); requesters[from].remove(to); 
friends[to].add(from);friends[from].add(to); v out = true } }; 
reject(/rom, to) = atomic { 

if (-irequesters[to].conta.±ns(from)) then v oM = false 

else { requesters[to].remove(from); requesters[from].remove(to);v oM = true } }; 
breakup (from, to) = atomic { 

if (-ifriends[to].contains(from)) then v out — false 

else { fnends[to]. remove (/rom); friends[from]. remove(io); t> out = true } }; 
get(id) — atomic {v oM — (fmends[id]. get, requester s[id]. get) } } 



constituent objects are grouped into arrays friends and requesters and have the type 
RWset of sets with a particular conflict-resolution policy (defined in §3.1). We use these 
sets to store account identifiers: friends[a] gives the set of a's friends, and requesters[a] 
the set of accounts with pending friendship requests to a. The implementation maintains 
the expected integrity invariants that the friendship relation is symmetric and the friend 
and requester sets of any account are disjoint: 



The composite operations allow issuing a friendship request, accepting or rejecting 
it, breaking up and getting the information about a given account. For readability, we 
use some further syntactic sugar in the operations. Thus, we replace v m with more de- 
scriptive names, recorded after the operation name and, in the case when the parameter 
is meant to be a tuple, introduce separate names for its components. Thus, from and to 
desugar to fst(«i n ) and snd(i;; n ). We also allow invoking operations on objects inside 
expressions and omit unimportant parameters to operations. 

The code of the composite operations is mostly as expected. For example, request 
adds the user sending the request to the requester set of the user being asked, after 
checking, e.g., that the former is not already a friend of the latter. However, this sim- 
plicity is deceptive: when reasoning about the behaviour of the data type, we need to 
consider the possibility of operations being issued concurrently at different replicas. 
For example, what happens if two users concurrently issue friendship requests to each 
other? What if two users managing the same institutional account take conflicting de- 
cisions, such as concurrently accepting and rejecting a request? As we argue in §5, it 
is nontrivial to implement the data type so that the behaviour in the above situations be 



Va, b. _/Hends[a].contains(6) 4=> friends [b]. contains (a); 
V 'a. friends[a]. get (~l requesters [a] .get = 0. 
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acceptable. Using the results in this paper, we can specify the desired social graph be- 
haviour and prove that the composite data type in Figure 3 satisfies such a specification. 
Our specification abstracts from the internal structure of the data type, thereby allowing 
us to view it as no different from the primitive set data types it is constructed from. This 
facilitates reasoning about programs using the data type, which we describe next. 

Programs. A program P consists of a series of data type and object variable decla- 
rations followed by a client. The latter consists of several commands C\, . . . , C n , each 
representing a user session accessing the store concurrently with others; a session is 
thus an analogue of a thread in shared-memory languages. An implementation would 
connect each session to one of the store replicas (as in examples in Figure 1), but this is 
transparent on the language level. Data type variables declared in P are used to specify 
the types of objects declared afterwards, and object variables are used inside sessions 
Cj, as per the typing rules. Sessions can thus invoke operations on a number of objects 
of primitive or composite types. By default, every such operation is executed within a 
dedicated transaction. However, like in composite data type implementations, we allow 
sessions to group multiple operations into transactions using atomic blocks included 
into the syntax of commands. We consider data types T and programs P up to the 
standard alpha-equivalence, adjusted so that v m and v out are not renamed. 

Technical restriction. To simplify definitions, we assume that commands inside 
atomic blocks always terminate and, thus, so do all operations of composite data types. 
We formalise this restriction when presenting the semantics of the language in §4. It can 
be lifted at the expense of complicating the presentation. Note that the sessions Cj do 
not have to terminate, thereby allowing us to model the reactive nature of store clients. 

3 Replicated store semantics 

A replicated store holds objects of primitive replicated data types and implements op- 
erations on these objects. The language of §2 allows us to write programs that interact 
with the store by invoking the operations while grouping primitive objects into com- 
posite ones to achieve modularity. The main contribution of this paper is a denotational 
semantics of the language that allows the reasoning about a program to reflect this 
modularity. But before presenting it (in §4), we need to define the semantics of the 
store itself: which values can operations on primitive objects return in an execution of 
the store? This is determined by the consistency model of causally consistent transac- 
tions [25, 17, 18, 23, 16, 1 1, 3], which we informally described in §1. To formalise it, we 
use a variant of the framework proposed by Burckhardt et al. [10, 11,9], which defines 
the store semantics declaratively, without referring to implementation-level concepts 
such as replicas or messages. The framework models store executions using structures 
on events and relations in the style of weak memory models and allows us to define 
the semantics of the store in two stages. We first specify the semantics of single oper- 
ations on primitive objects using replicated data type specifications (§3.1), which are 
certain functions on events and relations. We then specify allowed executions of the 
store, including multiple operations on different objects, by constraining the events and 
relations using consistency axioms (§3.2). 



A correspondence between the declarative store specification and operational mod- 
els closer to implementations was established elsewhere [10, 11,9]. Although we do 
not present an operational model in this paper, we often explain various features of the 
store specification framework by referring to the implementation-level concepts they 
are meant to model. 

The granularity abstraction of the denotational semantics we define in §4 allows 
us to pretend that a composite data type is a primitive one. Hence, when defining the 
semantics, we reuse the replicated data type specifications introduced here to specify 
the behaviour of a composite data type, such as the one in Figure 3, while abstracting 
from the internals of its implementation. 

3.1 Semantics of primitive replicated data types 

In a strongly consistent system, there is a total order on all operations on an object, and 
each operation takes into account the effects of all operations preceding it in this order. 
In an eventually consistent system, the result of an operation o is determined in a more 
complex way: 

1. The result of o depends on the set of operations information about which has 
been delivered to the replica performing o — those visible to o. For example, in 
Figure 1(a) the operation friends [a] .get returns 0 because the message about 
friends[a].add(b) has not yet been delivered to the replica performing the get. 

2. The result of o may also depend on additional information used to order some 
events. For example, we may decide to order concurrent updates to an object using 
timestamps, as is the case when we use the last-writer-wins conflicts resolution 
policy mentioned in § 1 . 

Hence, we specify the semantics of a replicated data type by a function F that computes 
the return value of an operation o given its operation context, which includes all we need 
to know about the store execution to determine the value: the set of events visible to o, 
together with a pair of relations on them that specify the above relationships. 

Assume a countably-infinite set Event of events, representing operations issued to 
the store. A relation is a strict partial order if it is transitive and irreflexive. A total 
order is a strict partial order such that for every two distinct elements e and /, the order 
relates e to / or / to e. We call a pair p e Op x Val = AOp of an operation o together 
with its parameter a an applied operation, written as o(a). 

Definition 1 An operation context is a tuple N = (p, E, aop, vis, ar), where p e 
AOp, E is a finite subset of Event, aop : E — > AOp, and vis (visibility) and ar (arbitra- 
tion) are strict partial orders on E such that vis C ar. 

We call the tuple M — (E, aop, vis, ar) a partial operation context. 

We write Ctxt for the set of all operation contexts and denote components of N and 
similar structures as in N.E. For a relation R we write (e, /) £ R and e — > f inter- 
changeably. Informally, the orders vis and ar record the relationships between events in 
E motivated by the above points 1 and 2, respectively. In implementation terms, the re- 
quirement vis C ar guarantees that timestamps are consistent with message delivery: if 



e is visible to /, then e has a lower timestamp than /. We define where vis and ar come 
from formally in §3.2; for now we just assume that they are given and define replicated 
data type specifications as certain functions of operation contexts including them. 

DEFINITION 2 A replicated data type specification is a partial function F : Ctxt — 1 
Val that returns the same value on isomorphic operation contexts and preserves it on 
arbitration extensions. Formally, let us order operation contexts by the pre-order C; 

(p, E, aop, vis, ar) C (p', E', aop', vis', ar') 

p = p A Bit e E ^bijective E' . 7r(aop) = aop' A 7r(vis) = vis' A 7r(ar) C ar', 

where we use the expected lifting of -k to relations. Then we require 

VAT, N' e Ctxt. N C N' A N e dom(F) =>■ N' e dom(F) A F(N) = F(N'). (3) 

Let Spec be the set of data type specifications F and assume a fixed Fb for every prim- 
itive type B e PrimType provided by the store. The requirement (3) states that, once 
arbitration gives all the information that is needed in addition to visibility to determine 
the outcome of an operation, arbitrating more events does not change this outcome. 

Replicated sets. We illustrate the above definitions by specifying replicated set data 
types with different conflict-resolution policies. The semantics of a replicated set is 
straightforward when it is add-only, i.e., its signature is {add, contains, get}. An 
element a is in the set if there is an add(a) event in the context, or informally, if the 
replica performing contains(a) has received a message about the addition of a: 

J 7 Ao S et(contains(a), E, aop, vis, ar) = (Be € E. aop(e) = add(a)). 

We define the result to be _L for add operations and define the result of get as expected. 2 
Things become more subtle if we allow removing elements, since we need to define 
the outcome of concurrent operations adding and removing the same element, as in 
the context N = (contains(42), {e, /}, aop, vis, ar), where aop(e) = add(42) and 
aop(/) = remove(42). There are several possible ways of resolving this conflict [7]: in 
add-wins sets (AWset) adds always win against concurrent removes (so that the element 
ends up in the set), remove-wins sets (RWset) act vice versa, and last-writer-wins sets 
(LWWset) apply operations in the order of their timestamps. We specify the result of 
contains in these cases using the vis and ar orders in the operation context: 

i ? A wset(contains(a), E, aop, vis, ar) = 

Be E E. aop(e) = add(a) A (V/ E E. aop(/) = remove(a) -i(e /)); 

jRWset(contains(a), E, aop, vis, ar) = 

Be e E. aop(e) = add(a) A (V/ £ E. aop(/) = remove(a) / ^> e); 

-FLwwset(contains(a), E, aop, vis, ar) = 

Be E E. aop(e) = add(a) A (V/ e E. aop(/) = remove(a) => f e), 

if ar is total on {e e E \ aop(e) e {add(_), remove(_)}}; 
F LWWs et(contains(a), E, aop, vis, ar) = undefined, otherwise. 

2 fioset is undefined on contexts with operations other than those from the signature. The type 
system of our language ensures that such contexts do not arise in its semantics. 



Thus, the add-wins semantics is formalised by mandating that remove operations cancel 
only the add operations that are visible to them; the remove-wins semantics additionally 
mandates that they cancel concurrent add operations, but not those that follow them 
in visibility. On the above context N, the operation contains (42) returns true iff: 

-■(e /) for AWset; / e for RWset; and / e for LWWset. As we show in §5, 
using a remove-wins set for requesters in Figure 3 is crucial for preserving the integrity 
invariant (2); friends could well be add-wins, which would lead to different, but also 
sensible, data type behaviour. 

3.2 Whole-store semantics 

We define the semantics of a causally consistent store by the set of its histories, which 
are certain structures on events recording all client-store interactions that can be pro- 
duced during a run of the store; these include operations invoked on all objects and their 
return values. The store has no control over the operations occurring in histories, since 
these are chosen by the client; hence, the semantics only constrains return values. Repli- 
cated data type specifications define return values of operations in terms of visibility and 
arbitration, but where do these orders come from? As we explained in §3.1, intuitively, 
they are determined by the way messages are delivered and timestamps assigned in a 
run of a store implementation. Since this highly non-deterministic, in general, visibility 
and arbitration orders are arbitrary, but not entirely. A causally consistent store provides 
to its clients a guarantee that these orders in the contexts of different operations in the 
same run are related in certain ways, and this guarantee disallows anomalies such as the 
one in Figure 1(a). 

We formalise the guarantee using the notion of an execution, which extends a history 
with visibility and arbitration orders on its events. A history is allowed by the store 
semantics if there is a way to extend it to an execution such that: (i) the return values of 
operations in the execution are obtained by applying replicated data type specifications 
to contexts extracted from it; and ( ii) the execution satisfies certain consistency axioms, 
which constrain visibility and arbitration and, therefore, operation contexts. 

Histories, executions and the satisfaction of data type specifications. We identify 
objects (primitive or composite) by elements of the set Obj, ranged over by uj. A strict 
partial order R is prefix-finite if {/ | (/, e) <E R} is finite for every e. 

Definition 3 A history is a tuple H = (E, label, so, ~), where: 

-EC Event. 

- label : E — > Obj x AOp x Val describes the events in E: //"label(e) = (u),p, a), 
then the event e describes the applied operation p on the object lo returning the 
value a. 

- so C E x E is a session order, ordering events in the same session according to 
the order in which they were submitted to the store. We require that so be prefix- 
finite and be the union of finitely many total orders defined on disjoint subsets ofE, 
which correspond to events in different sessions. 

- ~ C E X E is an equivalence relation grouping events in the same transaction. 
Since all transactions terminate (§2), we require that every equivalence class of ~ 



be a finite set. Since every transaction is performed by a single session, we require 
that any two distinct events by the same transaction be related by so one way or 
another: 

Ve,/.e~/Ae^/ =► e^fVf^e. 
We also require that a transaction be contiguous in so: 

Ve, f,g.e / g A e ~ g => e ~ / ~ g. 

An execution is a triple X = (H, vis, ar) of a history H and prefix-finite strict 
partial orders vis and ar on H.E, such that vis U ar C {(e, /) | H.ob]{e) = iJ.obj(/)} 
and vis C ar. 

We denote the sets of all histories and executions by Hist and Exec. We write H.ob](e), 
H.aop(e) and _ff.rval(e) for the components of iJ.label(e) and shorten, e.g., X.H.so 
to X.so. Note that the set H.E can be infinite, which models infinite runs. Figure 1(a) 
graphically represents an execution corresponding to the causality violation anomaly 
explained in §1. The relation ~ is an identity in this case, and the objects in this and 
other executions in Figure 1 are add-only sets (ADset, §3.1). 

Given an execution X, we extract the operation context of an event e e X.E by 
selecting all events visible to it according to X.v\s: 

ctxt(X,e) = (X.aop(e),E,(X.aop)\ E ,(X.v\s)\ E ,(X.ar)\ E ), (4) 

where E = (X.v\s)^ 1 (e) and -\ E is the restriction to events in E. Then, given a function 
F : Obj — 1 Spec that associates data type specifications with some objects, we say that 
an execution X satisfies F if the return value of every event in X is computed on its 
context according to the specification that F gives for the accessed object. 

DEFINITION 4 An execution X satisfies F, written X \= F, if 

Ve e X.E. (Xobj(e) e dom(F) => Xrval(e) = F(X.obj(e))(ctxt(X, e))). 

Since a context does not include return values, the above equation determines them 
uniquely for the events e satisfying the premise. For example, in the execution in Fig- 
ure 1(a) the context of the get from Wf a is empty. Hence, to satisfy F = (Xui. F AOset ), 
the get returns 0. If we had a vis edge from the add(6) to the get, then the latter would 
have to return {&}. 

Consistency axioms. We now formulate additional constraints that executions have 
to satisfy. They restrict the anomalies allowed by the consistency model we consider 
and, in particular, rule out the execution in Figure 1(a). 

To define the semantics of transactions, we use the following operation. For a rela- 
tion R on a set of events E and an equivalence relation <~ on E (meant to group events 
in the same transaction), we define the factoring R/^oiR over <~ as follows: 

- iiU((~;fl;~)-H), (5) 

where ; composes relations. Thus, R/~ includes all edges from R and those obtained 
from such edges by relating any actions coming from the same transactions as their 
endpoints, excluding the case when the endpoints themselves are from the same trans- 
action. We also let sameobj(X)(e, /) Xobj(e) = Xobj(/). 



Definition 5 An execution X = ((E, label, so, ~), vis, ar) is causally consistent if it 
satisfies the following consistency axioms: 

CausalVis. ((so U vis)/— )+ n sameobj(A") C vis; 
CAUSALAR. (so U ar) /<~ is acyclic; 

EVENTUAL. Ve e E. \{f e E I sameobj(JT)(e,/) A-.(e /)}| < oo. 

We write X |=cc ^ '/^ 1= ^ an< ^ causally consistent. 

The axioms follow the informal description of the consistency model we gave in § 1 . 
We explain them below; however, their details are not crucial for understanding the rest 
of the paper. Before explaining the axioms, we note that Definitions 4 and 5 allow us to 
define the semantics of a store with object specifications given by F : Obj — ^ Spec as 
the set of histories that can be extended to a causally consistent execution satisfying F: 

HistCC(F) = {H | 3vis, ar. (H, vis, ar) hcc F}. (6) 

To prove that a particular store implementation satisfies this specification, for every 
history H the implementation produces we have to come up with vis and ar that satisfy 
the constraint in (6); this is usually done by constructing them from message delivery 
and timestamps in the run of the implementation producing H . Here we rely on previous 
correctness proofs of store implementations [10, 11,9] and use the above declarative 
specification of the store semantics without fixing the store implementation. 

Causal consistency. The axioms CausalVis and CausalAr in Definition 5 en- 
sure that visibility and arbitration respect causality between operations. CausalVis 
guarantees that an event sees all events on the same object that causally affect it, i.e., 
those preceding it in a chain of session order and visibility edges (ignore the use of 
factoring over — for now). Thus, CausalVis disallows the execution in Figure 1(a). 
CausalAr similarly requires that arbitration be consistent with session order on all 
objects (recall that Xvis C X.ar). EVENTUAL formalises the liveness property that 
every replica eventually sees every update: it ensures that an event cannot be invisible 
to infinitely many other events on the same object. 

Transactions. The use of factoring over the — relation in CausalVis formalises 
the guarantee provided by causally consistent transactions that we noted in § 1 : updates 
done by a transaction get delivered to replicas together. According to CausalVis, a 
causal dependency established between two actions of different transactions results in 
a dependency also being established between any other actions in the two transactions. 
Thus, CausalVis disallows the execution in Figure 1(c), where the dashed rectangles 
group events into transactions. The axioms allow the execution in Figure 1(b) even 
when the operations by the same session are done within a transaction — an outcome 
that would not be allowed with serialisable transactions. 

4 Coarse-grained language semantics 

We now describe our main contribution — a coarse-grained denotational semantics of 
programs in the language of §2 that enables modular reasoning. We establish a corre- 
spondence between this semantics and the reference fine-grained semantics in §6. 



Fig. 4. Key clauses of the session-local semantics of commands. Here FHist and IHist are respec- 
tively sets of histories with finite and infinite event sets; a[v i-» a] denotes the function that has 
the same value as a everywhere except v, where it has the value a; and [ ] is a nowhere-defined 
function. We assume a standard semantics of expressions [G] : LState(X') — > Val. 

(A\E\-C) : (dom(Z\) ^ inj Obj) x LState(r) -> P((FHist x LState(r)) U IHist) 

{v = G)(obj,a) = {(H emf ,a[v^lGja]) \ H emj> = (0, [], 0, 0)} 
(v = x.o(G))(obj,a) = {(H e ,a[v a]) | e £ Event A a £ Val 

A H e — ({e},[e^(obj(x),o(lG}a),a)],<&,{(e,e)})} 
(atomic {C})(obj,a) = {((E, label, so, E x £),</) | ((£, label, so, ~), a') £ {C)(obj,a)} 



4.1 Session-local semantics of commands 

The semantics of the replicated store defined by (6) in §3 describes the store behaviour 
under any client and thus produces histories with all possible sets of client operations. 
However, a particular command C in the language of §2 generates only histories with 
certain sequences of operations. Thus, our first step is to define a session-local seman- 
tics that, for each (sequential) command C, gives the set of histories that C can possibly 
generate. This semantics takes into account only the structure of the command C and 
operations on local variables; the return values of operations executed on objects in the 
store are chosen arbitrarily. Later (§4.3), we intersect the set of histories produced by 
the session-local semantics with (6) to take the store semantics into account. 

To track the values of local variables S in the session-local semantics of a command 
A | S h C (Figure 2), we use local states a e LState(Z') = S — > Val. The semantics 
interprets commands by the function (A | £ h C) in Figure 4. Its first parameter obj 
determines the identities of objects bound to object variables in A. Given an initial local 
state a as the other parameter, (A | £ h C) returns the set of histories produced by 
C when run from a, together with final local states when applicable. The semantics is 
mostly standard and therefore we give only key clauses; see §A for the remaining ones. 
Recall that, to simplify our formalism, we require every transaction to terminate (§2). 
To formalise this assumption, the clause for atomic filters out infinite histories. 

4.2 Composite data type semantics 

The distinguishing feature of our coarse-grained semantics is its support for granularity 
abstraction: the denotation of a composite data type abstracts from its internal structure. 
Technically, this means that composite data types are interpreted in terms of replicated 
data type specifications, which we originally used for describing the meaning of prim- 
itive data types (§3.1). Thus, type variable environments _T and data types r h T : O 
(Figure 2) are interpreted over the following domains: 

[r] = dom(r) -> Spec: [r h T : 0} = [r] -> Spec. 

We use type to range over elements of J_T] . Two cases in the definition of J_T h T : O] 
are simple. We interpret a primitive data type B £ PrimType as the corresponding 
data type specification Fb, which is provided as part of the store specification (§3.1): 



Fig. 5. (a) A context N of coarse-grained events for the social graph data type soc in Figure 3, 
with an event eo added to represent the operation N.p. Solid edges denote both visibility and arbi- 
tration (equal, since the data type does not use arbitration). The dashed edges show the additional 
edges in vis' and ar' introduced in Definition 7. (b) An execution X belonging to the concreti- 
sation of N. The objects Wf a , uj fb , cj ra , cj rb correspond to the variables friends[a], friends[b], 
requester$[a], requesters[b] of type RWset. Solid edges denote both visibility and arbitration. 
We have omitted the session order inside transactions, the visibility and arbitration edges it in- 
duces and the transitive consequences of the edges shown. Dashed rectangles group events into 
transactions. The function j3 maps events in X to the horizontally aligned events in N. 
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\B\ type = Fb ■ We define the denotation of a type variable a by looking it up in the 
environment type: fajtype = type(a). 

The remaining and most interesting case is the interpretation Jr h D : O} of a 
composite data type 

D = let {xj = new Tj}j=\.. m in {o = atomic {C 0 }} oe o- 0) 

For type € [J 1 ], the data type specification F = fr h D : 0} type returns a value given 
a context consisting of coarse-grained events that represent composite operations on 
an object of type D (e.g., the one in Figure 5(a)). This achieves granularity abstraction, 
because, once a denotation of this form is computed, it can be used to determine the 
return value of a composite operation without knowing the operations on the constituent 
objects Xj that were done by the implementations C 0 of the composite operations in its 
context (e.g., the ones in Figure 3). We call events describing the operations on xj 
fine-grained. 

Informally, our approach to defining the denotation F of D is to determine the value 
that F has to return on a context N of coarse-grained events by "running" the imple- 
mentations C 0 of the composite operations invoked in N. This produces an execution 
X over fine-grained events that describes how C 0 acts on the constituent objects xj — a 
concretisation of N. The execution X has to be causally consistent and satisfy the data 
type specifications for the objects Xj. We then define F(N) to be the return value that 
the implementation of the composite operation N.p gives in X. However, concretis- 
ing N into X is easier said than done: while the history part of X is determined by 
the session-local semantics of the implementations C 0 (§4.1), determining the visibility 
and arbitration orders so that the resulting denotation be sound (in the sense described 
in §6) is nontrivial and represents our main insight. 



To define the denotation of (7) formally, we first gather all histories that an imple- 
mentation C Q of a composite operation can produce in the session-local semantics (•) 
into a summary: given an applied composite operation and a return value, a summary 
defines the set of histories that its implementation produces when returning the value. 

DEFINITION 6 A summary p is a partial map p : AOp x Val — "P(FHist) such that 
for every (p, a) G dom( ( o), p(p, a) is closed under the renaming of events, and for every 
H e p{p, a), H.so is a total order on H.E and H.~ = H.E x H.E. 

For a family of commands {A \ v- ln ,v out h C 0 } o6 o and obj : dom(Z\) -^; n j Obj, 
we define the corresponding summary I{C o } oe o]( 0 &.7) : AOp x Val — 1 'P(FHist) as 
follows: for d € O and a, b € Val, we let 

l{C 0 } oe0 l(obj)(o'(a),b) = 

{H | (H, [v,„ i ^ _, v out i ^ &]) e (atomic {C 0 >})(obj, [v m ^ a,v out ^ _L])}. 

For example, the method bodies C 0 in Figure 3 and an appropriate obj define the sum- 
mary p soc = I{C 0 } oe { request!accept ,...}](o&j). This maps the get operation in Fig- 
ure 5(a) to a set of histories including the one shown to the right of it in Figure 5(b). 

We now define the executions X that may result from "running" the implementa- 
tions of composite operations in a coarse-grained context N given by a summary p. 
The definition below pairs these executions X with the value c returned in them by the 
implementation of N.p, since this is what we are ultimately interested in. We first state 
the formal definition, and then explain it in detail. We write id for the identity relation. 

Definition 7 A pair (X,c) e Exec x Val is a concretisation of a context N with 
respect to a summary p : AOp x Val — 1 "P(FHist) if for some event e 0 ^ N.E and 
function (3 : X.E -> N.E l±J {eo} we have 



(V/ e (N.E). {X.H)\p-, (f) e p(N.aop(f), _)) A ((X.H)\ fj - 1{eo) e p(N.p, c)); (8) 



where vis' = iV.vis U {(/, e 0 ) | / € N.E} and ar' = A^.ar U {(/, e 0 ) | / € 
We write j(N, p) for the set of all concretisations of N with respect to p. 

For example, the pair of the execution and the value in Figure 5(b) belongs to 
l{N,Psoc) for N in Figure 5(a). When X concretises N with respect to p, the his- 
tory X.H is a result of expanding every composite operation in TV into a history of its 
implementation according to p. The function (3 maps every event in X.E to the event 
from N it came from, with an event e 0 added to N.E to represent the operation N.p; 
this is formalised by (8). The condition (9) further requires that the implementation 
of every composite operation be executed in a dedicated session. As it happens, it is 
enough to consider concretisations of this form to define the denotation. 



/3(X.so) C id; 
(3(X.v\s) - id C vis'; 
/3 _1 (vis') n sameobj(X) C Xvis; 
P(X.ar) - id C ar', 



(9) 
(10) 

(11) 
(12) 



The conditions ( 1 0)— ( 1 2) represent the main insight of our definition of the denota- 
tion: they tell us how to select the visibility and arbitration orders in X given those in 
N. They are best understood by appealing to the intuition about how an implementa- 
tion of the store operates. Recall that, from this perspective, visibility captures message 
delivery: an event is visible to another event if and only if the information about the 
former has been delivered to the replica of the latter (§3.1). Also, in implementations 
of causally consistent transactions, updates done by a transaction are delivered to every 
replica together (§1). Since composite operations execute inside transactions, the visi- 
bility order in N can thus be intuitively thought of as specifying the delivery of groups 

of updates made by them: we have an edge e' —} f between coarse-grained events 
e' and /' in N (e.g., request and accept in Figure 5(a)) if and only if the updates 
performed by the transaction denoted by e' have been delivered to the replica of /'. 
Now consider fine-grained events e, / G X.E on the same constituent object describ- 
ing updates made inside the transactions of e' and /', so that /3(e) = e' and (3(f) = f 

(e.g., ix) ra .add(6) and cj ra . contains (b) in Figure 5(b)). Then we can have e X v,5 > f if 

and only if e' > /'. This is formalised by (10) and (1 1). 

To explain (12), recall that arbitration captures the order of timestamps assigned 
to events by the store implementation. Also, in implementations the timestamps of all 
updates done by a transaction are contiguous in this order. Thus, arbitration in N can 
be thought of as specifying the timestamp order on the level of whole transactions 
corresponding to the composite operations in N. Then (12) states that the order of 
timestamps of fine-grained events in X is consistent with that over transactions these 
events come from. 

To define the denotation, we need to consider only those executions concretising N 
that are causally consistent and satisfy data type specifications. Hence, for F : Obj — 1 
Spec we let 

j(N,p,¥) = {(X,c)e 1 (N,p) I IhccF}. 

For example, the execution in Figure 5(b) belongs to j(N, p soc , F) for N in Figure 5(a) 
and F = (Xcj. F RWset ). As the following theorem shows, the constraints (8)— (12) are 
so tight that the set of concretisations defined in this way never contains two different 
return values; this holds even if we allow choosing object identities differently. 

THEOREM 8 Given a family {A \ v m , v out h C a } oe o, we have: 

VN.Vobji, obj 2 G [dom(Zi) ^ inj Obj]. 
VFi € [range(o&j 1 ) — > Spec].VF 2 € [range(o&j 2 ) ~~ * Spec]. 
(Vz G dom(Z\).Fi(o&j 1 (x)) = ¥ 2 (obj 2 {x))) => 

V(X 1)Cl ) G j(N, l{C 0 } oe0 j(obj ,),¥,). 

V(X 2 ,c 2 ) e j(N, [{C o } o£O ]( 0 6j 2 ),F 2 ). Cl = c 2 . 

This allows us to define the denotation of (7) according to the outline we gave before. 

DEFINITION 9 For (7) we let \T h D\ type = F, where F : Ctxt Val is defined as 
follows: for N £ Ctxt and c G Val, if 

3obj G [{xj | j = l..m} -J-inj Obj].3F G [range(o&j) -> Spec]. 

(Vj = l..m.¥(obj( Xj )) = {Tjjtype) A (_,c) G j(N, [{C 0 } oe0 ](o6j), F), 



Fig. 6. Semantics of T | Ah P. Here H ttl H' = [H.E W H'.E, //.label tt) //'.label, //.so U 
//'.so, ZZ.~ U Z/'.~); undefined if so is H.E W H'.E. 



ir | A h P] : [r] -> n o6je[dom (4)^, n| ob J ]((range(o6 J ) - Spec) -> P(Hist)) 
[let a = T in P](ft/pe, o6j',F) = \P\{type[a ^ ITjtype], obj ,¥) 
l\etx = new T \n Pj (type, obj ,¥) = LKPKtoPe. obj[x ^ u],¥[u M- [T]ft/pe]) 

w £ range(o&?')} 

[Ci || ... || C n ](type, obj,¥) = HistCC(F) n { W? =1 ^ | Vj = l..n. 

(//„_) G (Ci-Xoftj, []) V //, G <Cr,->(o6j, [])} 



then F(N) = c; otherwise F(N) is undefined. 

The existence and uniqueness of F in the definition follow from Theorem 8. It is easy 
to check that F defined above satisfies all the properties required in Definition 2 and, 
hence, F € Spec. According to the above definition, the denotation of the data type in 
Figure 3 has to give ({6}, 0) on the context in Figure 5(a). 

4.3 Program semantics 

Having defined the denotations of composite data types, we give the semantics to a 
program in the language of §2 by instantiating (6) with an F computed from these de- 
notations and by intersecting the result with the set of histories that can be produced 
by the program according to the session-local semantics of its sessions (§4.1). A pro- 
gram r | A h P is interpreted with respect to environments type, obj and F, which 
give the semantics of data type variables in T, the identities of objects in A and the 
specifications associated with these objects (Figure 6). A data type variable declaration 
extends the type environment with the specification of the data type computed from its 
declaration as described in §4.2. An object variable declaration extends obj with a fresh 
object and F with the specification corresponding to its type. A client is interpreted by 
combining all histories its sessions produce in the session-local semantics with respect 
to obj and intersecting the result with (6). Note that we originally defined the store se- 
mantics (6) under the assumption that all replicated data types are primitive. Here we 
are able to reuse the definition because our denotations of composite data types have 
the same form as those of primitive ones. 

Using the semantics. Our denotational semantics enables modular reasoning about 
programs with composite replicated data types. Namely, it allows us to check if a pro- 
gram P can produce a given history H by: (i) computing the denotations F of the 
composite data types used in P; and (ii) checking if the client of P can produce H 
assuming it uses primitive data types with the specifications F. Due to the granularity 
abstraction in our denotation, it represents every invocation of a composite operation by 
a single event and thereby abstracts from its internal structure. In particular, different 
composite data type implementations can have the same denotation describing the data 
type behaviour. As a consequence, in (ii) we can pretend that composite data types are 
primitive and thus do not have to reason about the behaviour of their implementations 



and the client together. For example, we can determine how a program using the so- 
cial graph data type behaves in the situation shown in Figure 5(a) using the result the 
data type denotation gives on this context, without considering how its implementation 
behaves (cf. Figure 5(b)). We get the same benefits when reasoning about a complex 
composite data type D constructed from simpler composite data types Tj as in (7): we 
can first compute the denotations of Tj and then use the results in reasoning about D. 

In practice, we do not compute the denotation of a composite data type D using 
Definition 9 directly. Instead, we typically invent a specification F that describes the 
desired behaviour of D, and then prove that F is equal to the denotation of D, i.e., that 
D is correct with respect to F. Definition 9 and, in particular, constraints (8)— (12), give 
a proof method for establishing this. The next section illustrates this on an example. 

5 Example: social graph 

We have applied the composite data type denotation in §4 to specify and prove the 
correctness of three composite data types: (i) the social graph data type in Figure 3; (ii) 
a shopping cart data type implemented using an add-wins set, which resolves conflicts 
between concurrent changes to the quantity of the same product; ( Hi) a data type that 
uses transactions to simultaneously update several objects that resolve conflicts using 
the last-writer-wins policy (cf. LWWset from §3.1). The latter example uses arbitration 
in a nontrivial way. Due to space constraints, we focus here on the social graph data 
type and defer the others to §E. 

Below we give a specification F soc to the social graph data type, which we have 
proved to be the denotation of its implementation D soc in Figure 3. The proof is done 
by considering an arbitrary context N and its concretisation (X, c) according to Def- 
inition 7 and showing that F S0C (N) = c. The constraints (8)— (12) make the required 
reasoning mostly mechanical and therefore we defer the easy proof to §E and only il- 
lustrate the correspondence between D soc and F soc on examples. 

The function F soc is defined recursively using the following operation that selects 
a subcontext of a given event in a context, analogously to the ctxt operation on execu- 
tions (4) from §3.2. For a partial context M and an event e e M.E, we let 

ctxt(M,e) = (M.aop(e),E, (M.aop)| E , (M.vis)| E , (M.ar)| B ), 

where E = (M.vis) _1 (e). Then 

F S0C (get(a),Af) = 

({b | 3e e (M.E). (M.aop(e) = accept((6,a) | (a, b))) A F S0C (ctxt(M, e)) A 
V/ e (M.E). (M.aop(f) G breakup((6, a) \ (a,b))) A F S0C (ctxt(M, e)) 

p vis 

=> f —> e}, 

{b\3ee (M.E). (M.aop(e) = request(6, a)) A F soc (ctxt(M, e)) A 

Vfe(M.E). (M.aop(/) e (accept | reject)((6, a) | (a, b))) A F S0C (ctxt(M, e)) 

=► / ^ e}); 

^SOC (accept(6,a),M) = 0 e snd( J F soc (get(o), M))). 



The results of request, reject and breakup are defined similarly to accept. For 
brevity, we use the notation (G\ \ G2) above to denote the set arising from picking 
either G\ or G 2 as the subexpression of the expression where it occurs. Even though the 
definition looks complicated, its conceptual idea is simple and has a temporal flavour. 
Our definition takes into account that: after breaking up, users can become friends again; 
and sometimes data type operations are unsuccessful, in which case they return false. 
According to the two components of F soc (get(a), M): 

1. a's friends are the accounts b with a successful accept operation between a and 
b such that any successful breakup between them was in its past, as formalised 
by visibility. We determine whether an operation was successful by calling F soc 
recursively on its subcontext. 

2. a's requesters are the accounts b with a successful request(6, a) operation such 
that any successful accept or reject between a and b was in its past. 

This specifies the behaviour of the data type while abstracting from its implementation, 
thereby enabling modular reasoning about programs using it (§4.3). 

Our specification F soc can be used to analyse the behaviour of the implementation 
in Figure 3. By a simple unrolling of the definition of F soc , it is easy to check that the 
two sets returned by F soc (get(a), M) are disjoint and, hence, the invariant (2) in §2 
holds; (1) can be checked similarly. Also, since F soc returns ({&}, 0) on the context in 
Figure 5(a), when the same friendship request is concurrently accepted and rejected, 
the accept wins. Different behaviour could also be reasonable; the decision ultimately 
depends on application requirements. 

We now illustrate the correspondence between D soc and F soc on examples and, on 
the way, show that our coarse-grained semantics lets one understand how the choice 
of conflict-resolution policies on constituent objects affects the policy of the composite 
data type. First, we argue that making requesters remove-wins in Figure 3 is crucial 
for preserving the integrity invariant (2) and satisfying F soc . Indeed, consider the sce- 
nario shown in Figure 7(a). Here two users managing the same account b concurrently 
issue friendship requests to a, which initially sees only one of them. If requesters were 
add-wins, the accept by a would affect only the request that it sees. The remaining 
request would eventually propagate to all replicas in the system, and the calls to get in 
the implementation would thus return b as being both a friend and a requester of a's, 
violating (2). The remove-wins policy of requesters ensures that, when a user accepts 
or rejects a request, this also removes all identical requests issued concurrently. 

If we made friends add-wins, this would make the data type behave differently, 
but sensibly, as illustrated in Figure 7(b). Here we again have two concurrently issued 
requests from b to a. The account a may also be managed by multiple users, which 
concurrently accept the requests they happen to see. One of the users then immedi- 
ately breaks up with a. Since friends are remove-wins, this cancels the addition of b 
to friends[a] (i.e., Wf a ) resulting from the concurrent accept by the other user; thus, b 
ends up not being a's friend, as prescribed by F soc . Making friends add-wins would 
result in the reverse outcome, and F soc would have to change accordingly. Thus, the 
conflict-resolution policy on friends determines the way conflicts between accept and 
breakup are resolved. 



Fig. 7. (Left) Coarse-grained contexts of the social graph data type together with the result that 
F soc gives on them. (Right) Relevant events of the fine-grained executions of the implementation 
in Figure 3 resulting from concretising the contexts according to Definition 7. We use the same 
conventions as in Figure 5. 
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Finally, if users a and b issue friendship requests to each other concurrently, a de- 
cision such as an accept taken on one of them will also affect the other, as illustrated 
in Figure 7(c). To handle this situation without violating (2), accept removes not only 
the request it is resolving, but also the symmetric one. 

6 Fine-grained language semantics, soundness and completeness 

To justify that the coarse-grained semantics from §4 is sensible, we relate it to a fine- 
grained semantics that follows the standard way of defining language semantics on 
weak consistency models [10, 6]. Unlike the coarse-grained semantics, the fine-grained 
one is defined non-compositionally: it considers only certain complete programs and 
defines the denotation of a program as a whole, without separately defining denotations 
of composite data types in it. This denotation is computed using histories that record 
all operations on all primitive objects comprising the composite data types in the pro- 
gram; hence, the name fine-grained. The semantics includes those histories that can be 
produced by the the program in the session-local semantics (§4.1) and are allowed by 
the semantics of the store managing the primitive objects the program uses (§3). 

We state the correspondence between the coarse-grained and fine-grained seman- 
tics as an equivalence of the externally-observable behaviour of a program in the two 
semantics. Let us fix a variable x lo € OVar and an object io e Obj used to inter- 
pret x\ Q . A program P is complete if 0 | x\ a : {o lo } h P. The operation 0; o on x\ Q 



models a combined user input-output action, rather than an operation on the store, and 
the externally-observable behaviour of a complete program P is given by operations 
on X\ 0 it performs. Formally, for a history H let observ(P) be its projection to events 
on io: {e e H | iJ.obj(e) = io}. We lift observ to sets of histories pointwise. Then 
we define the set of externally-observable behaviours of a complete program P in the 
coarse-grained semantics of §4 as [[P]cg = °bserv(jP]([], [x\ Q : io], [])). Note that our 
semantics does not restrict the values returned by 0; o , thus accepting any input. 

To define the fine-grained semantics of a complete program P, we flatten P by in- 
lining composite data type definitions using a series of reductions — > on programs 
(defined shortly). Applying the reductions exhaustively yields programs with only ob- 
jects of primitive data types, which have the following normal form: 

P ::= d || ... || C n | let x = new B in P 

Given a complete program P, consider the unique P such that P — >* P and 
P >• _. Then we define the denotation of P in the fine-grained semantics by the set 
of externally-observable behaviours that P produces when interacting with a causally 
consistent store managing the primitive objects it uses. To formalise this, we reuse the 
definition of the coarse-grained semantics and define the denotation of P in the fine- 
grained semantics as [P]fg = [P]cg- Since P contains only primitive data types, this 
does not use the composite data type denotation of §4.2. 

We now define the reduction — >. Let Comm be the set of commands C in Fig- 
ure 2. We use an operator subst that takes a mapping S : OVar x Op — ^ Comm and a 
command C or a program P, and replaces invocations of object operations in C or P 
according to S. The key clauses defining subst are as follows: 

subst(S, v = x.o(G)) = if ((x, o) dom(S)) then (v = x.o(G)) 

else (atomic {var v\. varw 2 . vi = G; (S(x, o)[vi/v m ,v 2 /v out \);v = v 2 }) 

subst(S, let x = new T in P) = let x = new T in subst(S\-, x , P) 
subst(S, let a = T in P) = let a = T in subst(S, P) 
substiSiCx || ... || C n ) = subst{S,Ci) \\ . . . \\ subst(S,C n ) 

Here v\, Vi are fresh ordinary variables, and S\^ x denotes S with its domain restricted 
to (OVar \ {x}) x Op. Applying subst to an assignment command does not change the 
command, and applying it to all others results in recursive applications of subst to their 
subexpressions. Then the relation — ► is defined as follows: 

V ::= [-] | let x = new T in V | let a = T in V 
V[\eta = T\nP] — -> V[P[T/a}} 

V[\et x = new (let {xj — new Tj} J= i.. TO in {o = atomic {C 0 }} o6 o) in P] 

— > V[\et{xj = newTj} j= i.. m in subst({{x,o)^C 0 \ oe 0},P)], 

where xj do not occur in P. The first reduction rule replaces data-type variables by their 
definitions, and the second defines the semantics of composite operations via inlining. 

Our central technical result is that the coarse-grained semantics of §4 is sound 
and complete with respect to the fine-grained semantics presented here: the sets of 
externally-observable behaviours of programs in the two semantics coincide. 



THEOREM 10 For every complete program P we have [P]fg = [-P]cg- 

We give a (highly nontrivial) proof in §D. The theorem allows us to reason about pro- 
grams using the coarse-grained semantics, which enables granularity abstraction and 
modular reasoning (§4.3). It also implies that our denotational semantics is adequate, 
i.e., can be used to prove the observational equivalence of two data type implementa- 
tions D 1 and D 2 : if [Di] = [-D 2 ], then [C[L>i]] F g = [C[-D 2 ]]fg for all contexts C of 
the form V[\et a = [— ] in P]. Note that both soundness and completeness are needed 
to imply this property. 

7 Related work 

One of the classical questions of data abstraction is: how can we define the semantics 
of a data type implementation that abstracts away the implementation details, includ- 
ing a particular choice of data representation? Our results can be viewed as revisiting 
this question, which has so far been investigated in the context of sequential [14] and 
shared-memory concurrent [12,24] programs, in the emerging domain of eventually 
consistent distributed systems. Most of the work on data abstraction for concurrency 
has considered a strongly consistent setting [12, 24]. Thus, it typically aimed to achieve 
atomicity abstraction, which allows one to pretend that a composite command takes 
effect atomically throughout the system. Here we consider data abstraction in the more 
challenging setting of weak consistency and achieve a weaker and more subtle guar- 
antee of granularity abstraction: even though our coarse-grained semantics represents 
composite operations by single events, these events are still subject to anomalies of 
causal consistency, with different replicas being able to see the events at different times. 

We are aware of only a few previous data abstraction results for weak consis- 
tency [15, 8, 5]. The most closely related is the one for the C/C++ memory model [6] 
by Batty et al. [5]. Like the consistency model we consider, the C/C++ model is de- 
fined axiomatically, which leads to some similarities in the general approach followed 
in [5] and in this paper. However, other features of the settings considered are dif- 
ferent. First, we consider arbitrary replicated data types, whereas, as any model of a 
shared-memory language, the C/C++ one considers only registers with the last-writer- 
wins conflict-resolution policy. Second, the artefacts related during abstraction in [5] 
and in this paper are different. Instead of composite replicated data types, [5] considers 
libraries, which encapsulate last-writer-wins registers and operations accessing them 
implemented by arbitrary code without using transactions. A specification of a library 
is then just another library, but with operations implemented using atomic blocks remi- 
niscent of our transactions. Hence, a single invocation of an operation of a specification 
library is still represented by multiple events and therefore [5] does not support granu- 
larity abstraction to the extent achieved here. Our work can roughly be viewed as start- 
ing where [5] left off, with composite constructions whose operations are implemented 
using transactions, and specifying their behaviour more declaratively with replicated 
data type specifications over contexts of coarse-grained events. It is thus possible that 
our approach can be adapted to give more declarative specifications to C/C++ libraries. 

Researchers and developers have often implemented complex objects with domain- 
specific conflict resolution policies inside replicated stores [21], which requires dealing 



with low-level details, such as message exchange between replicas. Our results show 
that, using causally consistent transactions, such complex domain-specific objects can 
often be implemented as composite replicated data types, using a high-level program- 
ming model to compose replicated objects and their conflict-resolution policies. Fur- 
thermore, due to the granularity abstraction we established, the resulting objects can be 
viewed as no different from those implemented inside the store. 

We specify composite replicated data types using the formalism proposed for prim- 
itive replicated data types by Burckhardt et al. [10]. Thus, the novelty of our results lies 
not in the specification formalism, but in achieving granularity abstraction that lets us 
consider a composite data type as primitive and thereby specify it in this way. Burck- 
hardt et al. also proposed a method for proving the correctness of data type implemen- 
tations. This method considers only primitive data types implemented inside the store 
in a low-level way (e.g., using message exchanges), whereas we consider composite 
data types implemented using transactions in a higher-level model. Thus, the technical 
challenges addressed by the two methods are different. 

Partial orders, such as event structures [19] and Mazurkiewicz traces [20], have been 
used to define semantics of concurrent or distributed programs by explicitly expressing 
the dependency relationships among events such programs generate. Our results extend 
this line of semantics research by considering new kinds of relations among events, 
describing computations of eventually consistent replicated stores, and studying how 
consistency axioms on these relations interact with the granularity abstraction for com- 
posite replicated data types. 



8 Conclusion 

In this paper we have proposed the concept of composite replicated data types, which 
formalises a common way of organising applications on top of eventually consistent 
stores. We have also presented a coarse-grained denotational semantics for these data 
types that supports granularity abstraction: the semantics allows us to abstract from the 
internals of a composite data type implementation and pretend that it represents a single 
monolithic object, which simplifies reasoning about client programs. Using a nontrivial 
example, we have illustrated how the denotation of a data type in our semantics specifies 
its behaviour in tricky situations and thereby lets one understand the consequences of 
different design decisions in its implementation. Finally, we have shown our semantics 
is sound and complete with respect to a standard non-compositional semantics. 

As we explained in §1, developing correct programs on top of eventually consis- 
tent stores is a challenging yet unavoidable task. Our results mark the first step towards 
providing developers with methods and tools for specifying and verifying programs in 
this new programming environment and expanding the rich theories of programming 
languages, such as data abstraction, to this environment. Even though our results were 
developed for a particular popular variant of eventual consistency — causally consistent 
transactions — we hope that in the future the results can be generalised to other consis- 
tency models with similar formalisations [9, 3]. 
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A Additional clauses of the session-local semantics 



(var v.C){obj, a) = (IHist n {C)(obj, a[v ^ _L])) U 

{(H,a'U om{s) ) | (H,a')e(C)(obj,a[v^±})}; 



seq(U,W) = 

{{{Et W E 2 , labeli W label 2 , soi U so 2 U (£1 x E 2 ), ~i U ~ 2 ), <r 2 ) | 

((Ei,labeli,soi,~i),<7i) e(7A ((£ 2 , label 2 , so 2 , ~ 2 ), 02) € VF(cti)}U 
W E 2 , label! W label 2 , soi U so 2 U (E 1 x E 2 ), ~i U ~ 2 ) I 

((£?!, labeli, soi,~i),cti) G 17 A (E 2 , label 2 , so 2 , ~ 2 ) e W(<n)} U 

(IHist nt/). 



Note that in the clause for local-variable declarations we assume an appropriate alpha- 
renaming of bound variables. 

B Characterisation of 7 (AT, p, F) in terms of abstraction 

In the rest of the appendix, we use an alternative, equivalent characterisation of 
7 (AT, p, F) given in the main text. Our characterisation is based on the notion of abstrac- 
tion. This characterisation will help us to manage the complexity of reasoning involved 
in the proofs of the theorems. 

Definition 11 An abstraction from a history H to a tuple (N, e 0 , c) of a context N, 
an event e 0 ^ N.E and a value c <E Val is a pair ((3, p) of a function j3 : H.E — > 
N.E tfcl {eo} and an summary p : AOp x Val — 1 "P(FHist) such that 



We write (/3,p) : H — >■ (N,eo,c) to mean that (/3,p) is an abstraction of H into 




(C 1 ;C 2 )(obj,a) = seq((C\)(ob h a), Xa 1 '. (C 2 )(obj ,a')); 
(while G do C)(obj,<j) = (greatestFix K)(a), 



where 




(V/ g {N.E).H\ p - Hf) e p(7V.aop(/),_)) A 
{H\ p - Heo) ep(N.p,c)) A /3(if.so) C id A p(H.~)C\d. 



{N, e 0 ,c). 



DEFINITION 12 An abstraction from an execution X to (N,eo,c) is an abstraction 
{fi,p): X.H -> (N, e 0 , c) smc/z that 

P(X.v\s) - id C vis'; 
/3 _1 (vis') n sameobj(X) C Xvis; 
/3(X.ar) - id C ar', 

w/zere 

vis' = iV.visU{(/,eo) | feN.E}; 
ar'-TV.ar U {(/, eo) | / G N.E}. 

We write ((3,p) : X — > (N,eo,c) to mean that ((3,p) is an abstraction of X into 
(N,e 0 ,c). 

It is immediate from our definition that 

7 (N, p) = {{X, c) | 3e 0 £ (N.E). 3(3. ((3, p) : X -+ (N, e 0 , c)}. 
From this observation follows the following lemma: 
Lemma 1. 

7 (iV, p, F) = {(X, c) | 3e 0 £ (N.E). 3/3.(/3, p) : X -+ (N, e 0 , c) A X hcc F}. 

C Proof of Theorem 8 

In the following we use H.op(e) and iLarg(e) to denote the components of iLaop(e). 

We define the notions of morphisms between histories and executions, which gen- 
eralise the abstraction from histories or executions to contexts in Definitions 1 1 and 12. 
For w G Obj we let 

Hist(w) = {H e Hist | H.obj(H.E) = {u}}; 
Exec(w) = {X e Exec | X.H G Hist(w)}. 

DEFINITION 13 A morphism from a history H to another history H', such that H G 
Hist and H' G Hist(w) for some uj, is a pair of a function (3 : H.E — > H' .E and a 
summary p : AOp x Val — "P(FHist) such that 

(Ve G (H'.E). H\ fi -i (e) G p(H'. aop(e), ff'.rval(e))) A 
p(H.so) - id = (H'.so)\ m . E) A 0(H.~) = (H'.~)\ m . E) . 

We write ((3, p) : H — > H' to mean that (/?, p) is a morphism from H to H'. 

LEMMA 14 For every morphism p) : H — > H', we have that 

Ve,feH.E.(e,f)€H.~ (/3(e), (3(f)) G 



Proof. Let p) be a morphism from H to H' . Consider e, / G H.E. By the defi- 
nition of morphism, (3(H.~) = (H 1 Hence, 

(e,/)eff.~ => {fi{e),P(f))€H'.~. 

Let us move on to the other implication. Assume that ((3(e), (3(f)) G Since 
(3(H.~) = (H'.~)\p( H . E ), there exist e', /' G i/.E 1 such that 

/3(e) = /?(e') A /?(/) = /?(/') A (e',f)eH.~. 

Let e" = /?(e') and /" = (3(f). Since (/3, p) is a morphism, 

H|p-i ( e») e p(ff'.aop(e"),tf'.rval(e")) A i^-i^) G p(H'.aop(f"), ff'.rval(/")). 

Recall that every history in the image of p uses the complete relation (i.e., a relation 
that relates all pairs of events) as its equivalence relation. Also, e, e' G (H\p-i( e "-)).E 
and /, /' G {H\ p -i {r) ).E. Hence, 

(e,e')etf.~ A (/',/) eff.~. 

Since (e', /') G if.<~, by the transitivity of if.<~, we have that (e, /) G i?.<~, as desired. 

□ 

DEFINITION 15 A morphism from an execution X G Exec to another execution X' G 
Exec(cj) is a morphism ((3, p) : X.H — > A'.iJ rac/z fto 

f3(XV\s) - id C A'.vis A /T^X'.vis) n sameobj(X) C A'.vis 
A /3(Xar) - id C X'.ar. 

We write ((3, p) : X — > X' to mean f/zaf (/3, p) is a morphism from X to X'. 

DEFINITION 16 An operation context N can be embedded into an execution X at an 
event e (jL N.E, denoted (N, e) =-> X, if and only if for some uj G Obj, 

X.E = N.E W {e} A X.obj(X.S) = {w} A A.so = 0 A A.~ = id 
A A.vis = A.vis U {(/, e) | / G A._E} A A.ar = A.ar U {(/, e) | / G N.E}. 

Proposition 17 For a// (3, p, X, N, e such that e & N.E, a, 

((3,p):X^(N,e,a) 

(3A'. (A, e) ^ X' A((3,p) : X ^ X' Aa = A'.rval(e)). 

Hence, 7 from §4 can be equivalently defined as follows: 

7 (A, p, F) = {(X, a) I Be N.E. 3(3. 3X' . (A, e) X' A (0, p) : A -> A' 

Aa = A'.rval(e) A A hcc F}. 

In the following we sometimes use this fact even without mentioning it explicitly. 



For H 1 ,H 2 e Hist and it : H 1 .E -*- bij H 2 .E we let 
H 1 k^H 2 Tr(^i.label) =^ 2 -labelA7r(^i.so) = i? 2 .soA7r(i? 1 .~) = ^ 2 .~; 

« iJ 2 37T. iJl « ff iJ 2 . 

For Xi,X 2 E Exec and n : X\.E ->bij -X2-E we let: 

X 1 m n X 2 Xi.iJw^ X 2 .FAtt(Xi .vis) =X 2 .visA(7r(Xi.ar)UX 2 .ar is acyclic); 

^i «rvai ^2 -Xi-E = A iJi.obj = if 2 .obj A i?i.aop = # 2 .aop A 

Xi.so = A" 2 .so A Xl.~ = X 2 .^ A Xi.vis = X 2 .vis A Xi.ar = X 2 .ar. 

We also let 

CExec = {X e Exec | {\X.E\ < oo) A 

3uj e Obj. Ifl g Hist(w) A X.so = 0 A X~ = id}. 

A history iJ is sequential if i/.so is total on We write SHist for the set of 

sequential histories. It is easy to see that all histories produced by the session-local 
semantics are sequential. For H e SHist we write H(n) for the n-th event in TJ.so, 
undefined when there is not one. We also write H\ n for the projection of H to the first 
n events in H.so; if n > \H.E\, we let H\ n = H. 

Proposition 18 (Determinacy) For A \ S h C we have: 

Mobj : dom(A) ->- inj Obj. Vffi, iT 2 e Hist. V<r, a u a 2 e LState(i:). 
{Hi, o~i), (H 2 ,o~ 2 ) € {C)(obj , a) A H\ w H 2 => a x = a 2 

and 

Mob] : dom(Z\) -h nj Obj.Vi2i,i? 2 e Hist. Vcr e LState(Z'). Vn. 

(F 1 ,_),(^ 2 ,_)e(C)(o6j,<7)A^ 1 |„« J ff 2 |„A(l<n<|^ 1 |,| J ff 2 |) => 
(n + 1 < |#i| n + 1 < |i? 2 |) A 

(n + l<|JTi| => #i.obj(#i(n + l)) = if 2 .obj(tf 2 (n + l)) 

A ffi.aop(ffi(n+ 1)) = i?i.aop(i? 2 (n + 1))). 

THEOREM 19 Given a family of well-typed commands {A \ v- m ,v out h C 0 } oe o, we 
have: 

Mobj e [dom(Z\) -> inj Obj].VF € [range(o6j) -> Spec]. 
VX(,X 2 e CExec. VX 1 ,X 2 e Exec.V/3i,/3 2 . 

(A, I{C 0 } oe0 ]( 0 &j)) : *i *i A (A, [{C 0 } o£0 ](o6i)) : X 2 -+ X' 2 A 

«rval ^ 2 A X 1 HCC F A X 2 HcC F => 

-X'l = X 2 A 37r : Xi.E ^ hij X 2 .£. ^ w w X 2 A V/ € &(/) - 



Proof. Consider 

{xj : Oj | j = l..m} | w in ,w 0 ut ^ C Q , o e O 

and 

obj e [{arj- I j = l..m} ^ inj Obj]; F e [range(o6j) -> Spec] 

and let p = I{C 0 } oe0 ] (067). 

We prove that the following holds for all X[ , X' 2 G CExec such that X[ ~ n3 \ X 2 
by induction on \X[.E\ = \X' 2 .E\: 

\/X u X 2 e Exec.Vft,ft. 

(A, p) : X, -> X( A (ft, p) : X 2 ->■ X 2 A Xj |= CC FAI 2 |= CC F => 
X( = X> 2 A 3^ : Ij.fi ^ bij X 2 .E. X, », X 2 A V/ G ft(/) - 

The base case when \X[.E\ = \X 2 .E\ = 0 is trivial. 

Consider X[,X' 2 e CExec, Xi,X 2 e Exec and ft, f3 2 such that 

*i «rvai X' 2 A (ft , p) : X\ — > X{ A (ft, p) : X 2 -> X 2 A Xx |= CC FAI 2 |= CC F. 

Let us choose an event e e X[.E that does not have successors in X[ .so U X( .vis U 
X[.ar, this is possible since X[ € CExec. Then e e X 2 .£? and it does not have succes- 
sors in X 2 .so U X 2 .v\s U X^.ar. Let 

Y l = X[\ X [.E-{e} A Y 2 = X 'l\x^.E-{e}\ 

then y/ w rva , Y 2 '. Let 

*1 = X l\ Xl .E-0- 1 (e) A y 2 = X 2 | Xa E _ /3 -i (e) . 

It is easy to see that Y x and Y 2 still satisfy CausalVis and CausalAr. If (/, g) e 
Xi.vis for some / e ^f 1 (e) and 5 e - / 9 1 " 1 (e), then (e,ft(#)) e A^.vis, 

contradicting the fact that e does not have successors in X[ .vis. Hence, such / and g do 
not exist, which implies that Y\ |= F. We similarly establish Y 2 |= F. 
Let 

Pi = PA Xl .E-f)-\e) A ^2 = #2| X2 . E _0-i (e) - 

Is easy to check that 

((3[,p):Y 1 ^Y{ A (ft,p) :F 2 ^y 2 '. 

We have thus established all the premisses of the induction hypothesis for Y[ and 
Y 2 . Applying it, we get that Y{ = Y 2 and for some tt : Y\.E — ^bij Y 2 -E we have 
Y 1 w w Y 2 andV/ e Y{.E.f3[(f) = #(*(/)). 

Let (o, a) = A^.aop(e) = X 2 .aop(e). Then 

((^.ir)^-!^, [u in H^_,w out H^^.rval(e)]) e (atomic {C 0 })(o6j, [u in i-»a, v out ^±\) 

A 

((X 2 .fl')| / 9-i (e) , [uin^-^out^^.rva^e)]) e (atomic {C 0 })(obj, [v ]n ^a, v out ^±}) 

(13) 



and, in particular, {X 2 .H)\ fj -i^ e y (X 2 .H)\ /3 -i^ e SHist. 
For n > 0 let 

E? = (((X 1 .H)\ fi -i {e) )\ n ).E A E% = {{{X 2 .H)\p-, {e) )\ n ).E- 

X™ — X\ | Y\ .EuE™ A X 2 = X 2 \y 2 .EUE$ ■ 

We prove by induction on n that 

3tt' : El ^ blJ £ 2 ".Xr rw X 2 " A (V/ e X?.E.fa{f) = f3 2 ((n W tt') (/))). 

The base case of n = 0 follows from ^ Y 2 and V/ € F/.S. /3[(f) = /3 2 (tt(/)). 

Assume that for some n > 0 and tt' : E™ ^bij E 2 we have X™ w^ir' XV, and 
V/eX 1 ".£;.A(/) = /3 2 ((7rW7r / )(/)).Then 

((^i-^)l ft -(e))U *V ((X 2 .H)\ p - 1(e) )\ n . (14) 

If n > (e)|, then the above implies 

(( X l- H )\fS-\e)) ~^ (( X 2- H )\f3- 1 (e))\\p- 1 (e)\- 

Due to (13), by Proposition 18 we get ^(e)! = (so that X? = and 

X r 2 L = X r 2 l+1 ) and 

i{Xi.H)\ p - 1(e) )U 1 = ({X 1 .H)\ p - 1{e) ) 

RV (( X 2-H)\ fj -i {e) ) = ((X 2 .H)\ l3 -i {e) )\ n+1 , 

as required. We obtain the same when n > |/3 2 ~ 1 (e)| in a similar way. 
Now assume that n < |/3f 1 (e)| and n < \/3 2 1 (e)\ and let 

e 1 = ((X 1 .H)\^ {e) )(n+l) A e 2 = ((X 2 .H)\ p - 1(e) )(n + 1). 

Due to (13) and (14), by Proposition 18 we get 

X!.obj(ei) = X 2 .obj(e 2 ) A X 1 .aop(e 1 ) = X 2 .aop(e 2 ). (15) 

Let tt" = 7r'[ei : e 2 ]; then X? +1 .H rs^, X™ +1 .H and 

/3!( ei ) = e = /3 2 (e 2 ) = /3 2 (( 7 rW7r")(e 1 )), 

as required. 

We now show (tt W 7r")P^ l+1 .vis) = X" +1 .vis. Consider (/, .9) e X" +1 .vis: 
- If / ^ ei and .9 ^ d, then /, 3 e Then jq l X™ implies 

((^')(/),(^')(.9))eX 2 \vis 

and, hence, 

((7rW7r")(/),(^wO(.9))e^2 l+1 -vis. 



- We have previously shown that there are no / e /3f 1 (e) and g e X\.E — /?f (e) 
such that (/, g) e X^vis. Hence, we are left with the case when g = e\, which we 
consider in the following. 

- If / € E[\ then (/, ei) € Xi.so. But then Xf w^tt' X 2 l implies 

((7rW7r')(/),e 2 ) eX 2 .so 
and, by CausalVis for X 2 , we have 

((7rW7r / )(/),e 2 )eX 2 .vis. 

This implies 

((7rW7r")(/),(^W7r")( ei ))eX 2 .vis. 

- Assume now that / G X X .E - /3f 1 (e). Then &(/) ^ /3i(ei) = e and (/3i,p) : 
Xi — > X( implies 

(/3 1 (/),e)eX(.vis. 
Since X( ss rva | X 2 , we also have 

(/3 1 (/),e)eX 2 .vis. 

Since e = /3 2 (e 2 ) and /?i(/) = /3 2 ((7T ttl 7r')(/)), this is equivalent to 

(^ 2 ((7rW7r / )(/)),^ 2 (e 2 ))eX 2 .vis. (16) 

We have Xi.obj(/) = A"i.obj(ei) and w^mir' XJ implies X 2 .obj((7r ttl 
7r')(/)) = Xi.obj(/). From this and (15) we get 

X 2 .obj(( 7 rW7r / )(/))=X 2 .obj(e 2 ). 

Given this and (16), from (/? 2 , p) : X 2 ^ X 2 we get 

((7rW7r')(/),e 2 )eX 2 .vis, 

which implies 

((^W7r")(/),(7rW^")( e i))eX 2 " +1 .vi S . 

We have thus shown that (tt W 7r")(X" +1 .vis) = X" +1 .vis. 
We now show that 

(7r«7r y/ )prr +1 .ar)UX£ +1 .ar 

is acyclic. Assume that there is a cycle in this relation. Since X™ w^ir' X%, we know 
that 

(7rW7r / )(X?.ar)UXJ.ar 
is acyclic. Hence, the above cycle contains e 2 and an edge 

(e 2 ,/) G (7rW^")(X" +1 .ar)UX 2 l+1 .ar 

for some /. Then 

(e 2 ,/) G X 2 " +1 .arV3 fl .( ei , ff ) G Xj l+1 .ar. 



Using the choice of e\ and e 2 , similarly to how it was done previously, we can show 
that none of these cases is possible, which establishes the desired acyclicity guarantee. 

Similarly to how we previously showed that Y\ \= F and Y 2 |= F, we can show 
X? +1 \= F and |= F. Let 

Z x = (X 1 " +1 . J ff,X 1 " +1 .vis,(X" +1 .arU(7rW7r")" 1 (^ +1 .ar)) + ) A 
Z 2 = (X 2 " +1 .iJ,X 2 " +1 .vis, (X^ +1 .arU (tt W 7r")(Xj l+1 .ar))+). 

From the above-established acyclicity guarantee, Z\ and Z 2 are executions. Since data 
type specifications preserve their value on arbitration extensions, we still have Z\ |= F 
and Z 2 |= F. Furthermore, from what we have shown so far and (15) it easily follows 
that ctxt(Zi, ei) w ctxt(Z 2 , e 2 ). Since data type specifications give the same values on 
isomorphic contexts, 

A? +1 .rval(ei) = Zi.rval(ei) = Z 2 .rval(e 2 ) = X£ +1 .rval(e 2 ). 

This finally establishes w^tt" X 2 + , completing the induction. 

Now choosing n such that n > |/3f 1 (e)| and n > \P 2 1 (e)\, we get X" = 
Xi and Jf 2 = X 2 . Then the statement just proved gives us that for some it' : 
{(Xi.H^p-i^.E ->- bij ((X 2 .H)\ l3 -i (e) ).E we have X x X 2 . As a conse- 

quence, 

( X l- H )\l3-\e) »V (^2-i?)| /3 -i (e) - 

Then by (13) and Proposition 18 we get X( .rval(e) = X 2 .rval(e), as required. □ 

PROPOSITION 20 Given a family of well-typed commands {A \ v- m7 v out h C 0 } oe o, 
we have: 

VN.Vobj 1 ,obj 2 G [dom(Z\) ^ inj Obj]. 

VFi G [range(o&j 1 ) -> Spec].VF 2 G [range(o&j 2 ) -> Spec]. 

(Va: G dom(Zi).Fi(o&j 1 (.T)) = F(o6j 2 (x))) => 

V(X 1>0 ) G 7 W [{C 0 } oe0 ](o6ii),Fi).3X 2 . (X 2 ,a) G 7 (JV, [{C 0 } oe0 ](o&j 2 ),F 2 ). 

Proof of Theorem 8. Assumed, o6j l5 o6j 2 ,Fi,F 2 ,Xi,ai,X 2 ,a 2 satisfying the 
conditions of the theorem. Since 

(Xi,ai)e7W [{CJoeo] (o6ii),Fi), 

for some e x <^ N.E we have 

3/M/M{<?o} oe o](0&?i)) :Xi (JV,ei,ai) AXi hcc F x . 

By Proposition 20 there exists Y 2 G Exec such that 

(l2,a 2 ) G 7 W [{C o }oeo](0&ji),Fi), 

i.e., 

3e 2 £ AT.£. 3/3 2 . (ft, ECojoeoKobj,)) : F 2 (N, e 2 , a 2 ) A y 2 hcc F x . 



Then it is easy to see that 

B&.i^liCojozoKobjJ) :Y 2 ^ (N,e u a 2 ) AY 2 hcc Fi. 

By Proposition 17, there exist X[, X' 2 such that 

{Pi, l{Co}oeoj{obj)) : X 1 -+ X[ A [{C 0 } o£0 ](o&j)) : F 2 ^ ^ A 
(iV, ei )M-X( A (iV,ei)M-^ A «! = Xi.rval(ei) A a 2 = ^.rval(ei). 

We can ensure that we have -X^Xj € CExec; then X{ « rva | X 2 . By Theorem 19 we 
get X[ = X' 2 , so that a\ — a 2 , as required. □ 



D Proof of Theorem 10 



In this section we prove the following statement, which implies Theorem 10. 
Theorem 21 IfP — > P', (Aen [P'] CG = [P]cg- 

The case of the first reduction out of the two given in §6 is standard. We therefore only 
consider the case of the second, discharged by Theorem 42 in §D (the D direction, i.e., 
soundness) and Theorem 47 in §D.5 (the C direction, i.e., completeness). To prove the 
former result, we first need to reformulate the data type denotation from Definition 9, 
which is the subject of §D.3. 



D.l Properties of the factoring operation ( — /~) 

We prove a few useful properties of the factoring operation (— /<~), which will be used 
in the proofs of our main results later. Let E be a set of events and <~ an equivalence 
relation on E. 

LEMMA 22 For all relations R on E and events e, eo, /, fa G E, 

(e * f A e ~ e 0 ^ fo ~ /) =► e ^ f. 

Proof. Let R, e, eo, /, fo be a relation and events satisfying the assumption of the 
lemma. If e 0 — > fo, by the definition of the factoring operation, 

e > f. 

Otherwise, there exist ei, /i G E such that 

(eo fo A e 0 ~ei / 0 ). 

Since ~ is transitive, 

e ~ ei A /i ~ /. 

Furthermore, e/ / and ei — s- f\. Hence, 

R/~ p 
e ► /, 

as desired. □ 



LEMMA 23 The factoring operation (— /~) is a monotone closure operator. That is, 
for all relations R, S on E, 

R c {R/~) A ((fl/~)/~) = (RH A (i? c S =► c (5/-)). 

PROOF. The first conjunct i? C (i2/~) is an immediate consequence of the definition 
of factoring. For the second, by the same consequence again, it suffices to prove that 

For the sake of contradiction, suppose that ((i?/~)/~) £ (R/r~>). Then, there exist 
e, e', /, /' such that 

erpf A e~ef^>f~f A (e, /) 0 

The first two conjuncts imply e ► / by Lemma 22. This contradicts the third con- 
junct. 

It remains to show the monotonicity of the factoring operation. Assume that R C S. 
Pick e, / e E such that e /. If e A /, then 

e ► /. 

Otherwise, there exist e 0 , /o € -E such that 

e// A e ~ e 0 A / 0 ~ /■ 

Since iJCS, the above formula implies e 0 — » /o- Hence, by the formula again, we 

s /~ 

have that e >• /. □ 

LEMMA 24 77ie factoring operation preserves union: for all relations R, S on E, 

(i2uS)/H = (fl/~)U(S/~). 
Proof. By the monotonicity of the factoring operation (Lemma 23), we have that 

{RHu(S/~)C(RuS)/(~). 
Hence, it suffices to prove the other subset relationship. Pick e, / £ E such that 

(RUS)/** 



If e RvJS ) f 7 by the definition of factoring, 



(R/~)U(S/~) 

e >■ /. 



Otherwise, there exist eo, fo € such that 



e// A e - e 0 / 0 ~ /. 



R S 

Then, cq — > fo or cq — > fo. In the former case, we have 

(e,/)e(i2/~)C(ii/~)u(S/~). 
Similarly, in the latter case, we have 

(e,/)e(S/~)C(ii/~)u(S/~). 

□ 

LEMMA 25 For a// relations R on E, 

(RH+/H = (R/~) + . 

This means that the transitive closure is well-defined over the set of ^-factored rela- 
tions. 

Proof. It suffices to show that for all events e, eo, e\, . . . , e n , f with n > 0, 

(e / / A e ~ eo A e„ ~ / A Vi € {0, . . . , n-1}. e, > e i+1 ) e — > f. 

Let e, e 0 , ei, . . . , e„, / be the events satisfying the assumption of the above implication. 
Then, 

e ^ e n . (17) 

This is because otherwise e ~ / by the transitivity of <~, but this would contradict 
the assumption that e ^ f. Furthermore, e ~ eo by assumption. Hence, there exists 
to e {0, . . . , n— 1} such that 

e~e m A e</>e m+i . 

By Lemma 22, 

e^>e m+1 . (18) 

Furthermore, by a similar argument now applied to / and e m (instead of e and e„), we 
get k G {to + 1, . . . , n} such that 

efe ~ / A e fc _i 7^ /. 

By Lemma 22 again, 

e*-i ^ /• (19) 
If fc — 1 = to, then e <~ efc_i. Since e ^ f, the relationship in (19) implies the desired 

R/~ p 
e > f, 

because of Lemma 22. Assume now that k — 1 ^ m. Then, k — 1 > to + 1. From (18) 
and (19), it follows that 

R/~ R/~ , 
e >■ e m+ i >• e fe _i >• ,/. 



This implies the desired e — ► /. □ 

Finally, we show a few properties that describe interactions between factoring and 
a function on events. Let E 0 , E\ be sets of events, and ~o, ~i equivalence relations on 
E 0 and E\, respectively. Also, consider a function (3 : E 0 — > E\ such that 

Ve,/e£ 0 .e~ 0 / /3(e) ~i /3(/). 
The following lemmas hold for these Eq, E\, ~i an d 
LEMMA 26 For relations R 0 on Eq, and R\ on E\, if 

Ro/~o = Ro A i2i/~i = i?i A i?^ = 
f/zen /or all e,feE n such that e 7^0 /, 

((/3(%)/~i)Ufl 1 )+ ( J RoU(/3- 1 (fl 1 )/~ 0 ))+^ n 

(/3(e) ► /?(/)) 4=^ (e ► /). 

Proof. First, we prove the right-to-left implication. Consider e, f e E 0 such that 

iJoU^-^JJi)/^) , 

e ► /• 

We will prove that 

m WR ^% m . (20) 

Note that from this follows the right-to-left implication. By the choice of e and /, 

e — ► / V e ► /. 

Since /3(i£o) Q (/3(i?o)/~i)> the first disjunct above implies the desired (20). Now 
suppose that the second disjunct holds. Note that ((3 o /3 -1 ){R\) C Hence, if 

e^>/, 



we get 



/3(e)^i>/3(/). 



This gives the desired relationship in (20). On the other hand, if for some e', /' € i?o, 



then 



z /3 1 (Ri) j,, n , . 

e -0 e > f ~ 0 / A e 7^0 /, 



(e) ~! /3(e') /3(/') -1 13(f) A /3(e) A /?(/), 



because (3 preserves ^ 0 and reflects ~i. Since ((3 o (3 1 )(R\) C the above rela- 
tionship implies that 

/3(e) /3(/). 



We have to show that 



Recall that = R\ by the assumption of the lemma. Hence, this relationship 

between /3(e) and 13(f) gives the desired (20). 

Next, we prove the left-to-right implication claimed in the lemma. Consider e, / <E 
E 0 such that 

m (WKo)/ - )UJ?i)+ ; /?(/). 

(floU(/3- 1 (fl 1 )/~ 0 )) + 

e > ,/. (21) 

Let i?Q = ( 9(i? 0 )/'~i. By our choice of e and /, there exist a sequence (e 0 , ei, . . . , e n ) 
in i?i with n > 1 such that 

/3(e) = e 0 A /?(/) = e„ A VO < i < n. (e* ^> e i+1 VeA e i+ i). 

We will show (21) by induction on the number of times that the first disjunct involving 
R' 0 holds. 

The base case is that it never holds for any element in the sequence (e 0 , . . . , e n ). In 
this case, we have 

/3(e) = e 0 ^ e n = 0(f). 

But i?i is transitive by assumption. Hence, j3(e) /?(/), which then gives the desired 
(21). 

Now let us consider the inductive case. In this case, there exists 0 < j < n such 

that e,j — ^ ej+i- Unpacking this, we get ej h ej + i, which is equivalent to the 

following: 

3eJ,eJ +1 e Ex. 

(ej -i e'j e' j+1 ~i e j+1 A ({ ej = e'j A e' j+1 = e j+1 ) V (e 3 fa e j+1 ))). 

(22) 

The first conjunct above implies that 

3e'!, e'! +1 e So. 0(e$f) = 4 A /3(e? +1 ) = e' j+1 Ae^ e? +1 . 

Let 

fc = min{i I ~i /3(e") A 0 < i < j} and 
Z = max{i | /3(e" +1 ) ~i e, A j + 1 < i < n}. 

Because of Lemmas 23 and 24, 

(i^Ufli)/(~i) = ((/8(i2o)/~i)/~i)U(i2i/~i) = (/3(i? 0 )/~i)Uii 1 = (i? 0 Ui?!). 
Hence, 

((fc > 0 A e fe _! /3(e;')) V (fc = 0 A /3(e) ~! 0(e?))) 

A ((/ < n A /3(e? +1 ) e I+1 ) V (I = n A 0(e? +1 ) ~! /?(/))) 



Since /3 reflects ~i, the above formula implies 

{{m (fl ° Ufll)+ ) py>) A e A e'j) V (e ~o e?)) 

A ((/3(e? +1 ) iKUBl)+ > W) A 4Vi T^o /) V (e? +1 ~ 0 /)). 
By the induction hypothesis, the above formula implies that 

((e > e 3 ) V (e -o e.j )) 

A ((e j+1 > /) V (e j+1 -o /))• 

We do the case analysis depending on which disjunct holds in the two conjuncts above. 

1. Subcase e e" and e" +1 / : Since e" e" +1 and e 7^0 / by assumption, 

Since i? 0 is ^o-factored, this gives the desired (21). 

2. Subcase e ^ 0 e" and e" +1 7^0 /: Then, 

e,+i ► /• (23) 



We consider two cases depending on whether e 7^0 e j'+i- Suppose that e 7^0 e j'+i- 
Then, since e" e j+i> 

-Ro/~o // 
e >• e J+1 . 

Since i? 0 is ^o-factored (i.e., Rq/^o = ^0). this and the relationship in (23) imply 
that 

e > f. 

Now suppose that e ^ 0 e j'+i- Then, since e 7^0 / by assumption and (i?o U 
(/3 _1 (.Ri)/<~o)) + is ^-factored, the relationship in (23) implies that 

(ji„u(r 1 (fii)/-o))+ , 

e > f. 

3. Subcase e 7^0 e" and e" +1 ^ 0 /: This subcase is symmetric to the previous one. 

4. Subcase e 7^0 e" and e" +1 7^0 /: Then, 

e > e } A e J+1 > ./. 

Since e" e j'+i' we 8 et tne desired 

e > f. 



This concludes the proof of this lemma. □ 

LEMMA 27 For all relations Rq on Eq, and R\ on E\, if 

Ro/^o — Ro A Ri/^i — R\ A — R\ 

A both Ri and (i?o U (/3 (i?i)/~o)) are acyclic 
A (3(Ro n ~ 0 ) -\dCR 1 

then (((/3(i? 0 ) — id) /~i) U R\) is acyclic. 

Proof. Let R' Q = ((3(Ro) — id)/~i. For the sake of contradiction, suppose that 
(.Rq U -Ri) is cyclic. Then, there exist 

eo, . . • , e„ e E\ for some n > 1 

such that 

. FtLuRi . RqURi 

(VO < I < n. ej > e i+ i) A e n > e 0 . 

We prove that the existence of such a cycle leads to contradiction, using induction on 
the number of times that R' 0 is used in the cycle. 

The base case is that R' 0 is not used at all. In this case, the sequence (e 0 , . . . , e„) 
demonstrates that i?i is cyclic. This contradicts our acyclicity assumption on R\. 

Let us move on to the inductive case. Suppose that R' 0 is used m > 0 times in the 
cycle (eo, . . . , e„). Then, there exists 0 < k < n such that 

Rg 

efc — > e( fe+1 ) mod ( n+1 ). 
By the definition of R' 0 , there exist e, / £ E 0 such that 

(3(e) ^P(f) A e^f A 

((/3(e) = e k A /?(/) = e (fe+1) mod ( „ +1) ) V 

(efe —i /3(e) A /3(f) ~i e (fe+1 ) mod („ +1 ) A e fe 7^1 e^+i) mod (n+i)))- 
The second disjunct in the last conjunct implies that 

/3(e) A /?(/) 

Hence, regardless of whether the first or second disjunct holds in the last conjunct, we 
have that 

(/?(/) ( *" UJ?l)+/ ^ m). (24) 

We do the case analysis on whether e ^ 0 /• Suppose that e ^ 0 /• Then, 

/3(e) W ~° Hd > /?(/). 
Thus, by the assumption that (3(R 0 fl ~o) — id C R lt 

(3(e) (3(f). 



This means that the cycle (eo, . . . , e„) can be formed by using R' 0 in m — 1 times as 
well. This lets us use the induction hypothesis and obtain contradiction. 

Suppose now that e 7^0 /■ Since ^ 0 is symmetric, / 7^0 e. Using this fact, we start 
from (24) and reason as follows: 

W) (KU " l)+/ - ; /3(e)) => (W) /3(e)) 

=» (/?(/) /3(e)) 

(K 0 U(/3- 1 (fl 1 )/~ 0 )) + 

==» (/ ► e). 

The first implication holds because all of R' Q , Ri and R' Q U i?i are ^i-factored (Lem- 
mas 23 and 24), and the set of such <~i -factored relations is closed under the transitive 
closure operation (Lemma 25). The second implication unrolls the definition of R' 0 and 
uses the monotonicity of XR'. (i?'/<~i U i?i) + (Lemma 23). The last implication holds 
because of Lemma 26. Since 

we have that 

(R 0 U(f3- 1 (R 1 )/^ 0 )) + 

e > e, 

which contradicts the acyclicity of (R 0 U (/? _1 (.Ri)/<~o)) + - □ 

We call a relation R (not necessarily a strict partial order) prefix-finite if for every 
e, {/ I (/,e) G is finite. 

LEMMA 28 For all relations R, S on a set E, if R is prefix-finite but (R U S) is not, 
there exists e € E such that 

^ J j SU(S;(J?.US)-;S) > ^ 

is infinite. Here (— ; — ) is the usual operation for relational composition. 

Proof. Consider relations R, S on a set E such that R is prefix-finite but (R U 5*) is 
not. Let 

Ro = (RUS). 
Since R 0 is not prefix-finite, there exists ee£ such that 

£' - {/ I / ^ e} 

is infinite. Since R is prefix-finite, there should be infinitely-many elements of E' that 
are not related to e via R + . This means that the following subset of E' is infinite: 

E" = {f I 3e f eE.f^e f ^ e}. 



Pick a witness e/ for each / in E" that satisfies the condition in the definition of E". 
Because of the prefix-finiteness of R, the set of these chosen witnesses e/ has to be 



finite. This means that one witness e f is reused infinitely-many times so that it is related 
to infinitely-many different /'s in the set E" above. Let us denote this witness by e w . 
By the reasoning just given, the set 

E'" = {/ | / ^ e w }. 
is infinite. Now notice that E'" satisfies the following equality: 

E = {/ I 3e f e E. j — > e f > e w \. 

Choose a witness e'j, for each / e E'" that satisfies the condition in the definition of E'" 
above. This time the set of chosen witnesses e'f is infinite. This is because otherwise 
there would exist one witness e'j that is related to infinitely-many elements in E'" by 
R*, but the existence of such a witness contradicts the prefix-finiteness of R. Since 
there are infinitely-many witnesses e'j, the following set is also infinite: 

{e f I e f >e w \, 

as claimed by the lemma. □ 

LEMMA 29 For all relations R 0 on E 0 , and R\ on E\, if 

Rq/^q = i?Q A Ri/^i = R\ A R^ = R\ 

A both R\ and (Rq U (/? _1 (i?i)/~o)) are prefix-finite 
A every equivalence class of^i is finite 

then ((/3(i? 0 )/~i) U R\) is prefix-finite. 

Proof. Let R 0 = p(R Q )/~i. For the sake of contradiction, suppose that (Rq U i?i) 
is not prefix-finite. Note that i?i is prefix-finite by assumption. By Lemma 28, there 
exists e e E\ such that 

t-i/ r r I r R 0 U (^0 i (R 0 URl ) * ^0 ) , 1 
^1 = 1/ I ./ > e \ 

is infinite. Since every equivalence class of ~ x is finite, the following subset of E[ is 
also infinite: 

e'{ = {f | / WW-^)-^), e A / A e} 

Now we can pick countably many elements /i ,...,/„,.. . from such that 

Vi,j >l.i^j => fi T^i /j, 

because, again, every equivalence class of <~i is finite. Since f is in the domain of the 
relation R' 0 and R' 0 = f3(Ro)/~\, there exist f [,..., f' n , ... £ Eq such that 

(Vi, j > 1. i ^ j => ft 7^ /') A (Vi > 1. /?(/;) ~i /i). 



Also, since e is in the range of the relation R' Q , there exists e' G E 0 such that 

e~i /3(e')- 

Recall that /, 7^1 e for every i > 1, and that /3 preserves Hence, for every i > 1, 

P(fi)faP&) A /^ 0 e'. (25) 



Also, for every i, 
so that 



floU(flo;(«oUfli)*;flo) 
Ji > e, 



(^Uit!) + 

Ji > e. 



Since (_Rq U i?i) + is ^i-factored (Lemmas 23, 24 and 25), the above relationship and 
the property in (25) imply that 

PUi) (R '" URl) \ I3{e') foreveryi>l. 
Because of (25), we can apply Lemma 26 here and derive 

/j >• e for every 1 > 1. 

This contradicts the prefix-finiteness of (R 0 U (/3 _1 (.Ri)/<~o))> the assumption of this 
lemma. □ 

D.2 Generalised axioms and lifting operation 

For X G Exec and R C (X.E) 2 we write (X, R) \= C cs F if X |= F and X satisfies 
the following version of the axioms CausalVis and CausalAr, and the additional 
axiom PrefixFiniteAr': 

CausalVis'. ((X.so U X.ws u i?)/(X~))+ n sameobj(X) C X.vis. 
CausalAr'. (Xso U X.ar U J?)/(X~) is acyclic. 
PrefixFiniteAr'. (X.so U Xar U R)/(X.~) is prefix-finite. 

We write X \= C cs F if X |= F and X satisfies CausalVis and CausalAr (but not 
necessarily Eventual). 
For 

X G Exec, w G Obj, H' G Hist(w), i? C (i?'.£) 2 , 0 : X.E -> tf'.E 
we define 

liftLY, if', fl, /?) = (if', ((JT'.so U (/3(Xvis) - id) U R)/(H'.~)) + , 
{{H'.so U (0(X.ar) - id) U R)/{H' .-))+). 

Lemma 30 For all 

X e Exec, wGObj, H' G Hist(cj), RC(H'.E) 2 , (j3, p) : X.H -> if 7 , 

*/ i?' = H 1 .so U (R/(H' -fa) is acyclic and pre fix- finite, and (X, /3^ 1 (R /+ )) satisfies 
CausalVis', CausalAr' and PrefixFiniteAr', ?/zen lift(X, if 7 , J?, /3) is an execM- 
fi'on satisfying CAUSALVIS and CausalAr. 



Proof. Let 

X = (H, vis, ar) = ((E, label, so, ~), vis, ar); 
H' = (E\ label', so', ~'); 
vis' = ((so' U (/3(vis) - id) U R)/~') + \ 
ar' = ((so' U (/?(ar) - id) U R)h') + . 

Recall that /3 preserves <~ and reflects <~' by Lemma 14. We will use this fact without 
mentioning it explicitly in this proof. 

We need to discharge the following four requirements: 

1. vis' C ar'; 

2. vis' and ar' are defined on the same object (in this case w); 

3. vis' and ar' are prefix-finite strict partial orders on E'; and 

4. (H 1 , vis', ar') satisfies CausalVis and CausalAr. 

The first requirement holds because vis C ar, and vis' and ar' are obtained by applying 
the following monotone operation on those vis and ar: 

XRq. ((so' U(/3(i? 0 )- id) U #)/-')+. 

This operation is monotone because it uses only monotone operators; for the mono- 
tonicity of (— /~'), see Lemma 23. The second requirement is an immediate conse- 
quence of the assumption that H' e Hist(oj). Since vis' and ar' are both transitive by 
definition and ar' includes vis', the third requirement follows if we show that ar' is 
acyclic and prefix-finite. We will prove the acyclicity of ar' later when we discharge the 
last requirement, in particular, the CausalAr axiom. For the prefix-finiteness of ar', 
we first notice that 

ar' = ((so' U (/?(ar) - id) U fl)/~')+ 

= ((so'/~')U((^(ar)-id)/~')U( J R/~'))+ 
= (so'u((/3(ar)-id)/~')U(i?/~'))+ 
= (((/3(ar)-id)/^')U(so'u( J R/^'))) + 
= (((/3(ar)-id)/~')Ui?') + 
C((/3(ar/~)/~')Ui?'+) + . 

The second equality holds because the factoring distributes over union (Lemma 24), 
and the third follows from the fact that so' is ^'-factored. The fifth equality just rolls 
the definition of R', and the last subset relationship uses the monotonicity of factoring 
(Lemma 23). Note that since R' is ^'-factored, so is R' + (Lemma 25). Furthermore, ~' 
is the equivalence relation from the history H', all of its equivalence classes are finite 
sets. Thus, by Lemma 29, it suffices to prove the prefix-finiteness of 

R'+ and (ar/~)U(/r 1 (.R' + )/~). 

By assumption, R' is prefix-finite, so R' + is prefix-finite as well. For the latter relation, 
we have 

(ar/^Ut/T 1 (# + )/~) - (arU/T 1 (i?' + ))/~ 



since the factoring operation preserves union (Lemma 24). The RHS of the equation 
above is prefix-finite because (X, P~ 1 (R' + )) satisfies the PrefixFiniteAr' axiom. 
The rest of the proof focuses on showing the fourth requirement. 

CausalVis. We prove the axiom as follows: 

((so' U vis')/-')+ = ((so'/-') U (vis'/-')) + 

= ((so'/-') U (((so' U (ftvis) - id) U i?)/-')+/~')) + 
= ((so'/-') U ((so' U (/?(vis) - id) U #)/-')+)+ 
= ((so'/-') U ((so' U (/?(vis) - id) U fl)/~')) + 
= ((so' U (/3(vis) - id) U i?)/-')+ 
= vis'. 

The first equality holds because factoring distributes over union (Lemma 24), and the 
second simply unrolls the definition of vis'. The third equality uses the fact that the 
set of factored relations is closed under transitive closure (Lemma 25), and the next 
equality is a simple fact on transitive closure. The fifth equality uses the distributivity 
of factoring over union (Lemma 24). The last equality is just the rolling of the definition 
of vis'. 

CAUSALAR. We need to prove the acyclicity of the following relation: 

(so' U ar')/-' = (so' U ((so' U (/3(ar) - id) U i?)/-')+)/-'. 

We simplify the RHS of this equation using properties of — ': 

(so' U ((so' U (/?(ar) - id) U i?)/-')+)/-' 
= (so'/-') U (((so' U (/3(ar) - id) U R)h') + h') 
= (so'/-') U ((so' U (/?(ar) - id) U #)/-')+ 
= (so'/-') U ((so'/-') U ((/?(ar) - id)/-') U (i?/-'))+ 
= ((so'/-') U ((/3(ar) - id)/-') U (i?/-'))+ 
= (so'u((/3(ar)-id)/-')U(i?/-'))+ 
= (((/3(ar)-id)/-')U J R')+ 
= (((/3(ar)-id)/-')U( J R'+))+ 
= (((/3(ar/-)- id)/-') U (#+))+. 

The first equality uses the distributivity of factoring over union, the second follows from 
Lemma 25, and the third uses the same distributivity again. The fourth is an immediate 
consequence of the transitive closure operation, and the fifth equality holds because 
so'/—' = so'. The sixth equality rolls the definition of R' . The next equality is a simple 
consequence of transitive closure. The last equality holds because (3 preserves — and 
reflects — ', so that 



((/3(ar)-id)/-') = ((/3(ar/-)-id)/-'). 



By our simplification above, it is sufficient to prove the acyclicity of the following 
relation: 

S=((/3(ar/~)-id)/~')U(i?'+)). 

Note that 

= (so' U = (so' U (i?/~')) + = R' + . 

The second equality holds because (so' U (i?/~')) is ^'-factored (due to so'/~' = so' 
and Lemmas 23 and 24) and the set of ^'-factored relations is closed under the transitive 
closure operator (Lemma 25). Furthermore, ar/^ is ^-factored (Lemma 23). Hence, by 
Lemma 27, to show the acyclicity of S, it suffices to prove the facts below: 

1. The relations R'+ and ((ar/-) U (/T 1 (#'+)/-)) are acyclic. 

2. 0((ar/~) n ~) - id C R'+. 

The acyclicity of R' + is one of the assumptions of this lemma. The other relation 
((ar/-) U is same as 

(arU/T 1 (# + ))/~ 

by Lemma 24. Hence, its acyclicity follows from the fact that (X, f3^ 1 (R' + )) satisfies 
CausalAr'. For the second condition, consider e, / e X.E such that 

P{e)?P(f) A e (ar/ ~ )n ~) /. 

By the definition of factoring, the latter condition implies that e / and e — /. Since 
e ~ /, we have 

e—>f V / — > e. 

The second disjunct here is not possible because it would contradict the fact that X 
satisfies the CausalAr axiom. Thus, the first disjunct holds, from which it follows 
that 

Since /3(e) ^ (3(f) and ((3, p) is a morphism from X.H to H' , the above relationship 
implies 

G8(e),0(/))eso , C#+, 
as desired. □ 

Lemma 3 1 For all 

X e Exec, weObj, if'eHist(w), RC(H'.E) 2 , ((3, p) : X.H -> if', 

if i?' = H'.so U (i?/ (H'.~ )) is acyclic and pre fix- finite, and (X, /3 (R' + )) satisfies 
CAUSALVis' one/ CausalAr', ffen (/J, p) is a morphism from X to \\ft{X, i?', i?, /3). 



Proof. Let X' = \\h(X, H', R, fi). By assumption, p) is a morphism from X.H 
to X'.H. Furthermore, X' is an execution by Lemma 30. Thus, it is sufficient to prove 
that 

/3(X.vis) - id C X'.V\s, /3' 1 (X' .vis) n sameobj(X) C X.vis, 

p(X.ar) - id C X'.ar. { b) 

The first and the last requirements hold because by the definition of the lift operator, we 
have 

X'.vis = ((ff'.soU (/3(X.vis) - id) U R)/(H'.~))+ D /3(X.v\s) - id, 
X'.ar = (( J ff'.soU(/3(Xar)-id)Ui?)/(i7'.-))+ D /3(Xar) - id. 

The rest of the proof will focus on showing the second requirement in (26). During 
the proof, we will use the fact that f3 preserves ~ and reflects <~' (Lemma 14), without 
mentioning it explicitly. 

Let R' = H' .so U (R/H'.~). To discharge the requirement, we use one important 
assumption that (X, ^~ 1 (R' + )) satisfies CausalVis': 

Xvis D ((X.soUXvisU^ 1 (i?' + ))/(X-)) + nsameobj(X). 

Hence, the requirement follows if we show that 

((X.soUXvisU/r 1 (i?'+))/(X.~))+ D p-^x'.ws). 

By the definition of X', this proof obligation is equivalent to 

((X.so U Xvis U r 1 (J?'+))/(X.~))+ 

D /3- 1 (((fl" / .soU( / S(Xvis)-id)Ui?)/(^ / .~))+). K ' } 

But the RHS is the same as 

/3-\((H'.so/H'.~) U ((/3(Xvis) - id)/ff'.~) U (R/H'.~))+) 

because of the distributivity of the factoring —/H'.~ with respect to the union operator 
(Lemma 24). Since H'.so/H'.~ = H' .so and R' = {H 1 .so U {R/H'.~)), 

p-\(H'.soU ((/3(Xvis) - id)/iT'.~) U (R/H'.~))+) 
= p- 1 ((((f3(X.v\s)-\d)/H'.~)UR')+) 
= r '((((^(Xvis) - id)/ff'.~) U #+)+). 

Meanwhile, the LHS of (27) is the same as 

((X.so/X~) U (X.vis/X.~) U {p- 1 (R' + )/X.~))+, 

because (— /X.<~) distributes over union (Lemma 24). Hence, our proof obligation can 
be further simplified to 

((Xso/XH U (X.vis/X~) U (f3- 1 (R' + )/X.~))+ 

D /3- 1 ((((/3(Xvis)-id)/H'.-)Ui?'+) + ). ( *> 



Pick e, / e X£ such that 



m imx^/H^u^ p{f) (29) 



We have to show that 



e ► /. (30) 

The rest of our proof uses case split on whether e — — ■> /. 
Assume that e — — ■» /. Then, 

Jf.so , „ X .so 

e > f V / > e. 

Note that the first disjunct implies the desired relationship in (30). The second disjunct 
also does, because it never holds. To see this, suppose that it did hold. Then, we would 
have 

/?(/) = /3(e) V /3(/)^/3(e). 
Both disjuncts here imply the presence of cycle in 

(((/3(X.vis)-id)/ir.~)Ui?' + ) + = (X'.vis). 

This contradicts the fact that X' is an execution (so its visibility relation is a strict partial 
order) (Lemma 30). 

Now assume that (e, /) ^ X.~. We weaken the relationship in (29) slightly and 
derive: 

/3(e) mx.*/x.~)/H>.~ ) u#+ ) + i M (31) 

Note that (X.v\s/X.~) is X.~- factored (Lemma 23), and also that R'+ is X'.~- 
factored (Lemma 25). Hence, we can apply Lemma 26 to the relationship in (31), and 
obtain 

ax.v\5/X.~)u(p- 1 (R'+)/X.~)) + 

e ► ./, 

which gives the desired relationship in (30). □ 



D.3 Reformulation of data type denotations 

Recall that a relation R on a set E is a partial equivalence relation if it is an equivalence 
relation on a subset Eq of E. This subset Eq is called the domain of R, denoted dom(i?). 
For X e Exec and a partial equivalence relation R on X.E such that R C X.<~, we 

let 

proj(X,i?) = 

((Xi?| dom ( fl ), Xlabel| dom (i{), X.sonR, X.~r\R), ^.vis| dom ( fl ), X.ar| dom(fl )). 

LEMMA 32 For aW X S Exec and partial equivalence relations R on X.E such that 
R C X.<~ ami dom(i?) is finite, the projection proj(X, i?) is also an execution. 



PROOF. Consider an execution X e Exec and a partial equivalence relation R on 
X.E such that R C X.-. Let 



((E, label, so, ~), vis, ar) = X, ((E' , label', so', -'), vis', ar') = proj(A, R). 
First, we discharge the requirements on <~'. Since R C ~, we have that 

R=(~nR) = -'. 

Hence, <~' is an equivalence relation on dom(_R), which is equal to (_Endom(i?)) = E'. 
Also, since ~' is included in ~ and every equivalence class of <~ is finite, equivalence 
classes of ~' are also all finite. Finally, for all e, / € E' , 

(e~'/) => ((e~/)A(e A/)) 

=> «(e^/)V(/^c))A(c A/)) 
=> ((e^A/)V(/^e)). 

The last implication uses the symmetry of the partial equivalence relation R. 

Second, we handle the requirements on so'. Since so' is obtained by restricting so, 
it inherits the prefix-finiteness of so. By the same reason, so' is irreflexive. It is also 
transitive, because it is the intersection of two transitive relations so and R. Thus, to 
prove that so' is a total order on finitely many disjoint subsets of E', it suffices to find 
a partition £ of E' with finitely many components, such that two different elements in 
E' are related by so' in one way or the other if and only if they belong to the same 
part of this partition. Recall that so is the union of total orders on components of some 
partition £e = {Ej}j e j of E. Let £r be the collection of all equivalence classes of R, 
and define a new collection of subsets of (E n dom(ii)) = E' as follows: 

£ = {Ej n E R I Ej e£ E A E R g £r}. 

Then, £ forms a partition of E'. By construction, so' relates two different elements e and 
/ from E' in one way or the other if and only if e and / belong to the same component 
of this partition £. Also, since dom(i?) is finite by assumption, £ has only finitely many 
components. The remaining requirement on so' is that so' is ^'-factored. This follows 
from the fact that no e, e', /, /' e E' satisfy 



e 



/'-'/ A -n(e~'/)- 



To see this impossibility, just notice that the above formula implies 

eAe'A/'A/ A -n(eA/), 

which is impossible because R is transitive. 

Third, we discharge the conditions on vis' and ar'. Both are the restrictions of vis 
and ar by the same relation dom(i?) x dom(i?), so they inherit the prefix-finiteness and 
irreflexivity of vis and ar, and relate events on the same objects only. Furthermore, by 



the same reason and the assumption that vis C ar, we have that vis' C ar'. It remains 
to show the transitivity of vis' and ar'. This is easy because vis' and ar' both are the 
intersection of two transitive relations: vis and E' x E' in the case of vis'; ar and E' x E' 
in the case of ar'. □ 



The next lemma uses the notation of factoring 

S/R 

for partial equivalence relations R. The definition of S/ R in this case is the same as that 
for the original factoring in §3.2. 

LEMMA 33 Let X e Exec be an execution and R a partial equivalence relations on 
X.E such that R C X- 

1. If X. so is R-factored (i.e., (X.so/R) C X.so), and X satisfies CAUSALVlS and 
CausalAr, then proj(X, R) also satisfies CAUSALVlS and CausalAr. 

2. 7fdom(i?) is closed under taking the inverse image with respect to X.vis, that is, 

{e | 3/ G dom(fl). e ^> /} C dom(i?), 

then 

VF. (X |= F => proj(X,i?) h F). 

PROOF. Consider an execution X e Exec and a partial equivalence relation R on 
X.E such that R C X.~. Let 

((E, label, so, ~), vis, ar) = X, {{If, label', so', ~'), vis', ar') = proj(X, R). 

We first prove the claim of the lemma regarding the CausalAr and CausalVis 
axioms. Assume that X.so is i?-factored and the execution X satisfies CausalAr and 
CausalVis. 

Note that in order to prove proj(A", R) satisfies CausalAr, we just need to show 

that 

((ar'Uso')/-') C ((arUso)/~), (32) 

because X already satisfies CausalAr and the RHS relation above is already acyclic. 
Let us simplify the proof obligation in (32) slightly by reasoning about its LHS as 
follows: 

((ar'Uso')/~') = ((ar'/-') U (so'/-')) = ((ar'/-') U so') C ((ar'/-') U so). 

Here the first equality uses the distributivity of factoring over union (Lemma 24), the 
second uses the fact that so' is —'-factored, and the last subset relation holds because 
so' is defined as the intersection of so with R. Our transformation above implies that in 
order to prove (32), it suffices to show 



(ar'/-') C ((ar/-)Uso). 



Since ar' C ar as well, we can further simplify the above subset relationship to the 
following property: 

Ve, e', /, /' G dom(i2). ((e e' ^ f /) A -n(e /)) => (e ^^°> /). 

(33) 

Pick e, e', /, /' that satisfy the assumption of the implication in (33). If -i(e — /), then 

ar/~ 

e > f, because — ' C — and ar' C ar. The desired conclusion in (33) follows from 

this. If e — /, we have 

(e^/) V (f^e). 

The first disjunct immediately implies the conclusion of (33). The second disjunct is, 
on the other hand, not possible. Suppose that it was. Since e f, we also have that 
e' rf>' /'. Furthermore, so is i?-factored and — ' is the same as R. Hence, we should have 
that 

/' ^ e'. 

This means that (so U ar) is cyclic, which contradicts the assumption that X satisfies 
CausalAr. 

Our proof that proj(X, R) satisfies CAUSALVlS has a similar structure as the proof 
that we have just given. In this case, we should show that 

((vis'Uso')/~') + C vis'. 

By definition, the LHS relation is defined over E', and the RHS relation is the same as 
vis n (E' x E'). Thus, the above subset relationship is equivalent to 

((vis'Uso')/~')+ C vis. 

Meanwhile, since X satisfies CAUSALVlS, we have that 

((vis U so)/^) + C vis. 

Hence, it suffices to prove that 

((vis' U so')/-') C ((vis U so)/-). 

Recall that the factoring distributes over union (Lemma 24), and that so' and so are 
already factored via — ' and — , respectively. Hence, we can further simplify the above 
subset relationship as follows: 

((vis'/-') U so') C ((vis/-) U so). (34) 

But so' = (so n — ') C so and vis' = (vis n (E' x E')) C vis. Hence, one way to prove 
the subset relationship in (34) is to show that 

Ve, e', /, /' G E'. ((e -' e' ^> /' -' /) A -n(c -' /)) =► (e S^lZ^ /). (35) 

Pick e, e', /, /' from E' that satisfy the assumption of the implication above. If -i(e — 
/), then e V ' 5 ^ > / and the desired conclusion of (35) follows. If (e — /), then 

(e^f) V (/^e). 



If the first disjunct holds, the conclusion of (35) follows immediately. The second dis- 
junct, on the other hand, never holds. This is because otherwise we have /' ^> e', so 
that 

f ^> e'. 

But we already have e' /', so by the transitivity of vis, we get e' ^> e', which 
contradicts the irreflexivity of vis. 

We now move on to the next claim of the lemma. Assume that 

{e | 3/ G dom(R). e /} C dom(i?). 

Consider a specification map F such that X |= F. We should show that proj (X, R) \= F. 
Let X' = proj(X, R). Pick e G E' such that X'.obj(e) G dom(F). Define 

N = ctxt(X, e) and N' = ctxt(X', e). 

We need to prove that 

X'.rval(e) = ¥(X' .ob](e)){N'). 

This proof obligation can be discharged if we show that N = N' . This is because from 
this equality follows that 

X'.rval(e) = Xrval(e) = ¥(X.ob](e)){N) = F(X'.obj(e))(iV'). 

Proving the equality N = N' is easy. Since dom(i?) is closed under taking the inverse 
image with respect to X.vis and it is the same as E', we have that 

{feE\ (/, e) G Xvis} = ({/ G E | (/, e) G X.vis} n Ef) 

= {/ € E' | (f,e) e X.visx (Ef x E')} 
= {feE>\(f,e)€X>.v\s}. 

The desired equality N = N' follows from this. □ 

For a function j3 : E — > E' and a subset E' a C E', we define a partial equivalence 
relation on E as follows: 

per(p,E' 0 ) = {(e,f) \ e, f G E A /3(e) = fi(f) A 0(e) G E' 0 }. 

COROLLARY 34 For all objects u>, executions X G Exec and X' G Exec(u;), mor- 
phisms (/3,p) : X — > A", specification maps F, and subsets E' Q ofX'.E, if E' 0 is finite 
and closed under the inverse image of A"'. vis, f/ien f/ze projection proj(X, per(/3, _Eq)) 
w an execution. Furthermore, if X satisfies CAUSALVlS, CAUSALAR, and F, then so 
does the projection. 



We sometimes denote the projection proj(A", per(/3, E' 0 )) in this corollary using a sim- 
pler notation: 



Proof of Corollary 34. Pick 

w G Obj, X G Exec, X' G Exec(cj), (/3, p) : X -> X', F 

that satisfy the assumptions of this corollary. Also choose a finite subset E' 0 of X'.E. 
Let 

R = per(f3,E' 0 ). 

We will derive the claimed conclusion of the corollary using Lemmas 32 and 33. Specif- 
ically, we will show that 

dom(i?) is finite A R C X~ A (Xso/i?) C Xso (36) 
A {e | 3/ G dom(i2). e ^> /} C dom(fl). 

The first conjunct of (36) is a consequence of the facts that E' 0 is finite and the 
inverse image of /3 for a finite set is also finite — the image should be the finite union 
of the event sets of histories selected from p(p, b) for some (p, b) but every history in 
p(p, b) has a finite event set. 

R 

We move on to the second conjunct of (36). Consider e, / G E such that e — ► /. 
Then, /3(e) = /?(/) by the definition of R. Since X'.~ is an equivalence relation, this 

x' ~ 

implies that /3(e) — — >■ /?(/). Now we use the fact that /3 reflects the equivalence 

relation (Lemma 14), and conclude that e — — ■> /, as desired. 

Next, we prove the third conjunct of (36). Consider e, e', /, /' G such that 

R i X .so P t R P . / R p\ 

e -> e' ► /' -> / A -.(e -> /). 

If -i(e — — ■> /), we have that 

J>f.so/X.~ 

e ► /, 

because R C X.<~. But A". so is already A". ^-factored, so e X ' s °> /, as desired. Now 

X ~ 

assume that e — — ■> /. Then, 

(e ► /) V (/ ► e). 

The first disjunct is the very conclusion that we look for. The second disjunct, on the 
other hand, never holds. Suppose that it did. Note that 

P(e) ? 0(f) A /3(e') ^ /?(/') 

R R R 

because -i(e — >• /) but e — > e' and /' — > /. Then, by the definition of morphism, 

/3(f) ^ 0(e) A /3(e') ^ /?(/')• 

Since /3(e) = /3(e') and /3(/) = 0(f), the relationships above imply that X' .so is 
reflexive, which contradicts the fact that A"'. so is a strict partial order. 



Finally, we show the last conjunct of (36). Pick e, / G X.E such that 
/ e Aom{R) A e f. 
If /3(e) = (3(f), then e — > f, so e should be in dom(i?). Otherwise, 

/3(e) ^> /?(/). 

Recall that by assumption, E' 0 is closed under the inverse image of X'.vis. Furthermore, 
since / G dom(_R), we should have that (3(f) G E' 0 . Hence, (3(e) G -Eq as well. This 
means that e G dom(i?). □ 

LEMMA 35 For all objects u>, executions X G Exec and X 1 G Exec(u;), morphisms 
((3, p) : X — > X', and events e G X'.i?, we /lave f/ze following well-formed abstraction: 

((3, p) : proj(X, R) ->■ (ctxt(X' ; e), e, X'.rval(e)) w/zere i? = per(/3, ctxt(X', e).£U{e}). 

Proof. Pick u,X,X',((3,p),e. Let 

Ar = ctxt(X',e), a = X'.rval(e), B,v = JV.EU{e}, 
i? = per(/?, £jv), X 0 = proj(X, J?). 

Since X'.vis is prefix-finite, N.E is finite. Hence, En is also finite. Furthermore, En 
is closed under the inverse image of X'.vis, because X'.vis is transitive. What we have 
just shown implies that proj(X, R) is a well-defined execution (Corollary 34). Let 

vis' = X.vis U {(/, e)\fe N.E}, ar' - X.ar U {(/, e) | / G N.E}. 

It suffices to show that 

(V/ G (N.E). (X 0 .H)\ fj - Hf) G p(X.aop(/),X'.rval(/))) 
A ((Xo.H)\ p - 1(e) ep(N.p,a)) A /3(X 0 .so) C id 
A £(X 0 .~)Cid A /3(X 0 .vis) - id C vis' 
A (3(X 0 .ar) - id C ar' A /? _1 (vis') n sameobj(X 0 ) C X 0 .vis. 

The first two conjuncts of (37) hold because ((3, p) is a morphism from X to X' and 
so, for every f £ En, 

(X 0 .H)y- 1{f) = (X.H)\ p -i (f) G p(X'.aop(/),X'.rval(/)). 

The next two conjuncts of (37) are immediate consequences of the definitions of R 
and the projection proj(X, R), as shown below: 

(3(X 0 .so) = P(X.soDR) C (3(R) C id, 
/?(X 0 .~) = 0(X.~nR) C (3(R) C id. 



We prove the fifth conjunct of (37) as follows: 

P(X 0 V\s) - id C (£(Xvis) - id) n (E N x E N ) 
C X'.visn (E N x Sat) 
= vis'. 

Here the first subset relationship holds because X 0 .vis is a restriction of Xvis and it is 
defined over dom(i?) = fi~ x (E N ). The next subset relationship uses the fact that (/?, p) 
is a morphism from X to X' . The following equality is an immediate consequence of 
the definition of vis'. 

The proof of the sixth conjunct is similar: 

P(X 0 .ar) - id C (/3(Xar) - id) n (E N x E N ) 
C X'.arn (E N x £jv) 
= ar'. 

The first subset relationship uses the facts that X 0 .ar is defined over dom(i?) and that 
it is a restriction of X.ar. The second subset relationship holds because (/3, p) is a mor- 
phism from X to X'. The last equality comes from the fact that X' .ar is an acyclic 
relation and includes A"'. vis. 

Finally, we prove the last conjunct of (37) as follows: 

/T^vis') n sameobj(X 0 ) C (^(X'.vis) n sameobj(X)) n (dom(i?) x dom(i?)) 

C X.vis n (dom(i?) x dom(ii)) 
= X 0 .vis. 

The first subset relationship uses the definitions of vis' and X 0 , the second comes from 
the fact that ((3, p) is a morphism from X to X', and the following equality follows 
from the definition of Xq. vis. □ 

Proposition 36 For all 

F, X e Exec, uj G Obj, H' E Hist(w), R C {H'.E) 2 , (/3, p) : X.if -> H' 

i/i?' = (if' .soU (R/H'.~)) is acyclic and prefix-finite, and (X, ^ _1 (i?'+)) |= CC s F, 
f/zen the following properties hold for X' = lift(X, H' ' , R, j3): 

1. X' is an execution, and satisfies CAUSALVlS and CAUSALAR. 

2. (/?, p) is a morphism from X to X' . 

3. For every e G X'.E, if we let R 0 = per(/3, {e} U ctxt(X', e).E), then 

proj(X,i? 0 ) hcc F A {/3, p) : pro]{X,R Q ) -> (ctxt(X', e), e, X'.rval(e)). 

PROOF. The first property follows from Lemma 30, and the second from Lemma 31. 
For the third property, we note that since (X, (3^ 1 (R'+)) \= C cs F, 



X hcc F. 



Picke e X'.E. Let 

F w = {e} U ctxt(X', e).E and F 0 = per(/3, Fjv)- 

Then, since X' Vis is prefix-finite, En is finite. Also, it is closed under the inverse image 
of X' .vis. Thus, by Corollary 34, proj(X, R 0 ) is an execution such that 

pro S (X,R a ) hcc F. 

Furthermore, by Lemma 35, we have the following well-defined abstraction: 

(/3,p) : pro](X,Ro) -> (ctxt(X' , e), e, X'.rval(e)). 

□ 

LEMMA 37 For all F, F ami p, we have that 

VN. V(X, a) e 7(iV, p, F). F(N) = a 

if and only if for all 

I G Exec, weObj, H' e Hist(w), RC(H'.E) 2 , /3 : X.E ^ H'.E, 
we have that 

^(/3, p) : Xif H' A (H'.so U (R/H'.~)) is acyclic and prefix-finite 
A (X,/3- 1 ((ff'-soU( J R/^'H)+)) hccsF) => lift(X, hcc [w ^ F] 

PROOF. Consider arbitrary F, F and p. We show the equivalence in the proposition 
for these F, F and p. 

"Only if". Pick 

I G Exec, weObj, H' e Hist(w), i? C {H'.E) 2 , /3 e [X.E ^ H' .E] 
such that 

(/?, p) : Iff ff' A (if .so U (R/H'.~)) is acyclic and prefix-finite 
A (X./T^/f .so U (i?/if .-))+)) |=ccs F. 

We need to show that 

\\h(X,H',R,p) |= 

Let 

X' = \\h(X, H',R,/3). 

By Proposition 36, X' is an execution satisfying CAUSALVlS and CAUSALAR. Hence, 
it is sufficient to prove that 

X' |= 



Picke G X'.E. Then, 

X'.obj(e) = to. 

Let 

N = ctxt(X',e), a = X'.rval(e), and R 0 = per(/3, {e} U iV.£). 
Then by Proposition 36, 

proj(X,i? 0 ) |=cc F A (0,p) : prqjLY,^) ->• (JV,e,o). 
This implies that 

(proj(A:,i2o),o)e7Wp,F). 
Thus, by the assumption of the proposition, 

F(N) = a. 

We have just shown that X' \= [to i-> F], as required. 
"If'. Pick 

JV and (X,a)€7(JV,p,F). 

We have to prove that 

F(JV) = a. 

Since (X, a) G 7(-/V, p, F), there exist (3 and e such that 

e £ 7V.£ A (/3, p) : X -> (N, e,a) A X |= cc F. 
By the second conjunct here, for every / G N.E, there exists a/ € Val such that 

(X.H)\ fj - Hf) ep(N. a op(f),a f ). 

We abuse the notations slightly and let a e = a and iV.aop(e) = N.p. Pick an arbitrary 
object lo G Obj. Define an execution X' as follows: 

X'.E = N.E W {e'} A X'.label(/) = (w, AT.aop(/), a/ ) (for all / G iV.E U {e}) 
A X'.so = 0 A X'.~ = id 
A X'.vis = N.vls u {(/, e) | / G jV.F} 
A X'.ar = 7V.arU{(/,e) | f e N.E}. 

It is relatively easy to check that X' is an execution, if we do not forget to use the 
following facts: (i) X'.E = N.E U {e} is finite; (ii) e is not in N.E; (iii) both N.v\s 
and N.ar are strict partial orders; (iv) N.v'\s C iV.ar. Also, since ((3, p) is an abstraction 
from X to (N, e, a), we have the following morphism from X to X': 

(f3,p):X^X'. 

Let 

H' = X'.H and R' = H'.so U (X'.v\s/H'.~). 



Then, R' = X' Vis. Hence, it is acyclic. This also implies that R' is prefix-finite, be- 
cause it is defined over the finite set X'.E. We will next show that (X, 
satisfies CausalVis', CausalAr' and PrefixFiniteAr'. 

Let us start with CausalVis'. Note that, since X.vis is transitive, 

p- 1 (R! + ) = /3- 1 ((x'.vis)+) = /r^x'.vis). 

Using X' .so = 0, X.<~ = id and properties of f3, we get 

/3(X.so U Xvis) - id = {/3(X.so) - id) U (/3(Xvis) - id) 
C X.soU X.vis 
= X.vis. 

From these observations and the same fact that X'.so is the empty relation and X.~ is 
the identity relation we derive the following equalities: 

((Xso U Xvis U /r 1 (i?' + ))/X~)+ 

= ((XsoUXvisU/r 1 (X.vis + ))/X~)+ 

= ((XsoUXvisU/r 1 (X.vis))/X~)+ 

= (((Xso U Xvis)/X~) U ((3- 1 (X'.v\s)/X.^)) + 

= (((Xso U Xvis)/X~) U /?- 1 (X.vis)) + 

= ((XsoUXvis)/X-)+U (/3 _1 (X.vis))+ 

= ((Xso U Xvis) /X~)+ U /T 1 (X.vis). 

The first equality holds because R' = X.vis, the second follows from the transitivity 
of X.vis, and the third uses the distributivity of the quotienting over the relation union. 
The fourth follows from the fact that for all e\, e 2 , e 3 , e 4 € X.E, 

((ei, e 2 ) e X~ A (e 2 , e 3 ) € /^(X.vis) A (e 3 , e 4 ) G X~) 

=> (e^e/T^'-vis). U8j 

The last equality holds because the inverse image of a transitive relation is also transi- 
tive. The most tricky part is the fifth equality. It holds because for all e 0 , e\, e 2 , e 3 , e 4 e 

((e 0 , ei) e X~ A (ei, e 2 ) e (XsoUXvis) A (e 2 , e 3 ) e X~ A (e 3 , e 4 ) € /T^X.vis)) 
((e 0 , ei) e X~ A (ei, e 2 ) € (Xso U Xvis) A (e 2 , e 4 ) S /T 1 (X.vis)) 
=> ((eo, g X~ A (ei, e 4 ) e /T^X.vis)) 
=> (e 0 ,e 4 )e/3- 1 (X.vis), 

where the first and third steps use (38) and the second step uses the transitivity of X.vis 
and the inclusion /3(XsoUXvis) C (idUX.vis). Because of what we have just shown, 

((Xso U X.vis U /3- 1 (i?'+))/(X-))+ n sameobjpf) 

= ((Xso U Xvis)/(X~))+ n sameobj(X) U /T^X.vis) n sameobj(X) 
C Xvis. 



The last subset relationship holds because X satisfies the CAUSALVlS axiom and (/?, p) 
is a morphism from X to X' . 

To show CausalAr', we notice that 

/3((XsoUXvisUXar)/X~) - id C X'.visUX'.ar (39) 

and also that 

(XsoUXvisUXarU/3 _1 (i?' + ))/A'.~ 

= (X.so U X.vis U X.ar U ^(X' .v\s + ))/X.~ 
= (X.so U X.vis U X.ar U (X' .v\s)) / X .~ 
= ((X.so U X.vis U X.ar)/X.~) U /T^X'.vis). 

Furthermore, (X.so U Xvis U X.ar) /(X.~) is acyclic. Thus, if (X.so U X.vis U X.ar U 
,S _1 (i?' + ))/(X.^) is cyclic, this cycle should contain an edge from p~ 1 (X' V\s). But 
in this case, because of (39), (5 maps this cycle to a cycle in X' that has edges only from 
X'.vis and X' .ar. This contradicts the fact that X' .vis U X' .ar is acyclic. 

The last axiom is PrefixFiniteAr'. Since (f3, p) is a morphism from X to X' and 
X'.E is finite, X.E should also be finite. This implies the PrefixFiniteAr' axiom. 

We have thus established that (X, /3~ 1 (R' + )) satisfies CausalVis', CausalAr' 
and PrefixFiniteAr'. Since R' = X'.vis is acyclic and prefix-finite, 
\\ft(X, H',X'.V\s, /3) is an execution satisfying CausalVis and CausalAr by 
Lemma 30. Furthermore, since X |=cc F and H' £ Hist(w), by our assumption we 
have 

\\h(X,H',X'.\/\s,p) |= [w i y F]. (40) 

We now show a certain correspondence between lift(X, H', X' .vis, 0) and X' . First, 
their histories are the same since we chose H' = X' .H. 
Next, 

lift(X,i3' / ,jr.vis,/3).vis = ((H 1 .so U (/3(X.v\s) - id) U X'.vis)/X'.~) + 

= ((/3(X.v\s) - id) U X'.vis)+ 
= (X'.v\s) + = X'.vis. 

The second equality holds because H' .so = 0 and X'.~ = id. The third equality comes 
from the fact that (f3, p) is a morphism from X to X' and so f3(X.v\s) — id C X'.vis. 
The fourth follows from the transitivity of X'.vis. 
Third, 

m(X,H',X'.v\s,p).ar = ((H'.so U (/3(X.ar) - id) U X'.vis)/X'.~)+ 
= ((/3(Xar)-id)UX'.vis)+ 
C (X'.arUX'.vis) + 
= (X.ar)+ = X'.ar. 

The second equality holds because H' .so = 0 and X'.<~ = id. The next inclusion holds 
because (/3, p) is a morphism and so /3(X.ar) — id C X'.ar. The last two equalities use 
the facts that X'.vis C X'.ar and X'.ar is transitive. 



Thus, lift(X, H', X' .vis, (3) and X' are identical, except the latter may have a bigger 
arbitration relation. Since F preserves its value on arbitration extensions (Definition 2), 
from (40) we get 

This in turn gives 

a = X'.rval(e) = F(ctxt{X', e)) = F(N), 
as required. □ 

We compare specifications F, F' C Spec using the following order: 

F C F' 

if and only if 

ViV e Ctxt. N e dom(F) => (TV e dom(F') A F(iV) = F'(N)). 

Using this order, we define an operation that selects minimal specifications from a given 
set of specifications: for all T C Spec, 

max(J-) ={Fe J | ^BF' e J. F ^ f' A F C F'}. 

Then from Lemma 37 we get 

Corollary 38 

{[P h let {xj = new T.,}j = i.. m in {o(v m ) : v out = atomic {C 0 }} oe0 ■ Ojij} = 

( {F | Vo&j e [{a;, | j = ^ inj Obj]. 3F e [range(o6j) -+ Spec]. \ 

{Vj = l..m.F{obj( Xj ))£ [Tj]77)A 

(VX e Exec.Vw e Obj.ViT e Hist(cj).Vi? C (H'.Ef.Mfi : X.E->H'.E. 
max ((/3, [{C7 0 }o e0 ](o&.?)) = -+ H' 

A (H' .so U (R/H'.~) is acyclic and prefix-finite) 
A (X.rW-so U (R/H'. -))+)) |= ccs F) 
V =>■ lift(X, if', i?, /?) |=cc [w h-> F])} J 

D.4 Soundness 

Throughout this section, we fix an object variable environment {xj : Oj \ j = l..m} 
and a collection of commands 

{xj : Oj | j = l..m} | v in ,v out h C 0 , o G O. 

DEFINITION 39 For iJ, i?' e Hist we write (/3,p,oj) : H ^> H' if the function (3 : 
H.E — > H' .E, summary p : AOp x Val — "P(FHist) and object lo € Obj are such that 

(Ve e (ff'.obj(e) 7^ w e e A /3(e) = eA ff.label(e) = ff'.label(e)) 

A (ff'.obj(e) =uj eg H.E A H\ p -i (e) e p(i2"'.aop(e), ff'.rval(e)))) 
A/3( J ff.so)-id = (^ / .so)| /3(H . S ) 
A^( J ff.~) = ( J ff'.~)| /3(if . B) . 



We note that (/3, p, cj) : H =>■ iT implies 

Ve,f,geH.E.e^f^>gAl3(e)=!3(g) =► /3(e) = £(/) = /3( 5 ), (41) 

for otherwise we would have /3(e) g ' 5 °> /?(/) g ' 5 °> /3(<?) and /3(e) = /3(g), contra- 
dicting the transitivity and irreflexivity of H' .so. 
Let 

(|CD(o6j,tr) - {H | ff g (C)(obj,a) V (if, _) e (C)(o6j, a)}. 
Proposition 40 Assume 

A U {x : O} | E h C; 
Z\ U {ar,- : Oj | j = l..m} | h sw&s£({(x, o)^C„|oe O}, C). 

TTien 

Vo&j : dom(Zl U : O i | j = l..m}) -h nj Obj. 
Vcr : E -> Val.Vw g Obj - range(o6j). 

VH g ^.sMfest({(a;,o) C 0 | o g O}, C)D(o&7, <t). 

3tf' e <\C\)(obj\ov 3 r-{ Xj \ j =i..m}[x ^ w],ct).3/3 : ff.E -> 

((/3, [{C 0 } o60 ](o6j| {xj | j=1 .. ro} ),w) : H => H'). 

Let Pc range over clients: 

Pc ::= Ci || ... || C„. 

We let 

(C\ || ... || C„)o6j = {|+Jj =i Hi | Vj = l..n. ^ e ^D(o6i, [])} . 

Then the clause for the denotation of a client can be rewritten as 

Id || ... || C n j(type,obj,¥) 

= {H | H e (Ci || . . . || C n ) o&j A 3vis, ar. (tf , vis, ar) hcc F}. 

From Proposition 40 we get 

Corollary 41 Assume 

®\Au{x:0}hP c ; 
<D\Au{ Xj : Oj | j = l..m} h su&si({(a;, o)^C„|oe O}, P c ). 

Then 

Mobj : dom(Z\ U {xj : Oj \ j — 1..™}) — J-^ Obj. Vu; g Obj — range(o&j). 

\/H g (su&si({(a;, o) H- C D | o g O}, P c ))obj. 

3ff' g (Pc)(o6i|ovar-{, 3 b=i..m}[a; ^ w]).3/3 : ff.E -> 

(08, [{C 0 } oe0 ](o6i),w) :H=>H'). 



We now discharge the most difficult case in the soundness direction of Theo- 
rem 21 — that of the data-type-inlining reduction. 

Theorem 42 (Soundness) Let 

D = (let {xj = new Tj} j=1 .. m in {o(v m ) : v out = atomic {C 0 }} oe0 ); 
P 2 = (lets = new D in P); 

P 1 = (let {x 3 = new Tj}j = i.. m in subst({(x, o) i-> C 0 \ o G O}, P)), 
where P 1 and P 2 are complete. Then [P 1 ]cg Q I-P 2 ]cg- 

Proof. Let 

®\{x io :{o ]o }}UAlj{x:0}hP 2 ; 
0 I {^io : {o io }} U A U {xj : 0 3 | j = l..m} h P£ 

be the client parts of P 1 and P 2 , respectively, so that 

Pi = subst({(x,o) i-> C„ | o e 0},Pc)- 

Consider any o6j 0 : (dom(Z\) U {x lo } U {xj \ j = l..m}) — h n j Obj such 
that o6j 0 (xi 0 ) = io and F 0 : (range(o£>j 0 ) — {io}) — > Spec such that Vj = 
l..m. F 0 (o6j(xj)) G [7}] []. Further, consider any execution 

X 0 = (H 0 ,vis 0 ,ar 0 ) = ((£o, label 0 , so 0 , - 0 ), vis 0 , ar 0 ) G I-PcKIL o&?0' F o)- 

In the following, we also use selectors such as obj 0 for this and other executions. We 
also take w G Obj - range(o6j 0 ) and define obj' 0 = obj 0 \ O v ar _{ Xj \ j=1 „ m y[x ^ w]. 
Let 

F = [£>][]; i = range(o6i 0 | {x . b=1 .. m} ); F' 0 = F 0 | O bj-L[w ^ F]. 

The goal of the following development is to construct Xq such that 

observ(Xo.ff) = observL^'.ff) A Xg G IP C 2 ]([L obj' Q ,¥' 0 ). 

Since X Q G [P^]([], o6j 0 ,F 0 ), we have # 0 G (Pc 1 ) 0 ^ and |=cc F 0 . From 
the former, by Corollary 41 for some 

H' 0 = (^,label' 0 ,so' 0 ,~' 0 ) G (P c 2 >o&j' 0 (42) 

and /3 0 : P 0 -P -> Pq-P we have (0 O) 1{C 0 } oe0 ] (o&j), w) : P 0 => Pq- 
Let 

F = F 0 |l; o6j = o6j 0 |{ Xj .| j= i.. m }; 
X = (H, vis, ar) = ((E, label, so, ~), vis, ar) = X 0 \e 

and /3 = /3qU for £ = {e | objJ,(A>(e)) - ^}; 
H 1 = (E', label', so', ~') = H' 0 \ E , for P' = {e | obj' 0 (e) = lj}; 



It is easy to see that 

(Ve G E. obj(e) e L) A (Ve EE 0 -E. obj 0 (e) £ L). (43) 

Then observ(i? 0 ) = observ(i^). We also have X E Exec, H' E Hist(w) and 
(P,l{Co}oeo}(obj)) :H^H'. 

For r C E Q x E 0 we let lib(r) = r| £ and client(r) = r|£ 0 _B; for r C EJ x EJ we 
let lib 7 (r*) = r\ E ,. 

Let 

Q =/3o(((so 0 Uviso)/-o) + )-id; 
R = \\b'((so' Q U (Q/~{,))+); 

X' = (#', ((so' U (/3(vis) - id) U ((so' U CS(ar) - id) U 

Then, since F = [D] [], by Corollary 38 and Lemmas 30 and 31 we get 

((((■R/~ ; ) U so') is acyclic and prefix-finite) A (X, /^((so' U (i?/~')) + )) Hccs F) 
=> X' E Exec A X' |=ccs [w H- F] A (/?, 1{C 0 } oe0 ]( 0 6j)) : X X'. 

(44) 

Proposition A: Q/~d « transitive. Take e',f',g' E E' 0 such that 



and consider three cases. 
1. e' ~d /' ~' 0 g'. Then 



"1 11C11 

0, ,, C? 



e> ^ f ^ g'. 



Taking into account (/3 0 , l{C 0 }oeoj(obj), u) : H 0 => H' 0 , for some e, fi,f 2 ,g € 
Fo we have 

A)(e) = e' ; /? 0 (/i) = W2) = /'; Po(g)=sf; 

((so 0 Uvis 0 )/~o) + . . ((so 0 Uvis 0 )/~o) + 

e >■ 7i ~o 72 ► 9- 

Then e ~ 0 /i ~o h ~o .9 and, hence, 

sori j. „ so 0i 

e — > /i ~o 72 — ► .9 

and any pair of the four events is related by soo- The case of g e contra- 
dicts (41); hence, e ^> 5 . If /3 0 (e) = /3 0 (s), then 



/•/ 5O 0 / 5 °0 fl 

J ' .9 ' 7 j 

contradicting the properties of sOq. Hence, /3o(e) ^ /?o(<7) and (e',g') E Q. 



2 - /' T^o 9 '■ Then for some e i,fi,f^9i € K we have 

/ / „/ Q. fl I el I fl Q. J II 

Hence, for some e\, /i, j2, Q\ € i?o we nave 

A)(ei) = e' i; A>(/i) = /i; W2) = f' 2 ; Mgi) = g[; 

((so 0 Uvis 0 )/~o)+ ((so 0 Uvis 0 )/~o) + 
ei ► Jl ~0 J2 ► 5l 

and /2 t^o 5i- Because of the latter, for some J3 £ E$ we have 

((so 0 Uvis 0 )/~o) + . . (so 0 Uvis 0 )/~o . ((so 0 Uvis 0 )/~o) + 
ei ► /l <~0 J2 ► J3 > 91 

and / 2 7^0 jV By the definition of factoring, this implies 

((so 0 Uviso)/~o) + „ (so 0 Uviso)/~o „ ((so 0 Uviso)/~o) + 

ei > Ji ► J3 ► 5i, 

j , , . ((so 0 Uvis 0 )/~o) + i 

and ji 7^0 51, so that e\ > g\. 

Since f\ 7^0 51, we cannot have e\ ^0 5i : if this were the case, then similarly to 
the above we would be able to show that 

((so 0 Uviso)/~o) + 

Ji > ei, 

contradicting CausalAr for Xq. Since /?o(ei) = /?o(5i) implies ei ^0 5i> we 
get that /3o(ei) 7^ 0o(di) an d, therefore, (e' l7 <j4) e Q. Since ei 7^0 5i, we cannot 
have e[ 7^0 g[ and, hence, (e',g') G Q. 
3. e' 7^0 /'. This case is analogous to the previous one. 

■ 

Proposition B: (so' Q U (Q/~' a )) + = so' 0 U ((sOq)*; (Q/~o); (sOq)*). Consider 
(e' 0 ,/o) € (sOq U (Q/^o)) + . Then there is a path from e' 0 to in so^ U (Q/~o). 
By Proposition A, Q/^' 0 and sof, are transitive. Hence, we can assume that the edges 
from these two relations alternate on the path. 

Consider first the case when all events on the path are from the same transaction 
according to <~q. Then every edge is in so' 0 U Q and, since Q C Q\p 0 (E 0 )> tne P atn * s m 

so[,U((so' 0 )^(so^ o(So) UQ)+;(so^*) 
C so^ U ((so' 0 )*; ((A)(soo) - id) U Q)+; (so' 0 )*) 
Cso[,U((so' 0 )*;Q+;(so' 0 )*) 
Cso[,U((so' 0 )*;Q/~' 0 ;(so' 0 )*) 

as required. 

Assume now that the path contains events from at least two different transactions. 
We can ensure that the path does not contain edges 

s°oU(Q/~o) 

ei > e 2 



for ei <~' e 2 , since, e.g., we can replace any sequence of edges 

s°oU(Q/~o) s°oU(Q/~o) x>' 0 U(Q/~'o) 

e\ > e 2 > ...en > e„+i 

such that e\ ~' e 2 ~' . . . <~' e„ and e„ 7^' e n +i by a single edge 

s°oU(Q/~o) 

ei >• e n+ i 

for which ei 7^' e n +i. 

Assume the path contains a fragment of the form 

e , QA^ f , <^ g > Stk h >. (45) 

then e' 7^ f, f 7^ g' and g' 7^ ft'. Then for some e' 0 , f' Q , g' 0 , h' 0 e E' 0 we have 

e ~o e o — ► Jo ~o / — ► .9 ~o 9o —> h o ~o h > 



Hence, 



e ^0 e o ' Jo ' 9o ' "0 ^0 " i 



Since Q C Q|^ 0 ( Bo ). we have 

(/o.ffo) e so oUo(So) = (A)(so 0 ) - id) C Q, 

and thus 

e ~o e o Jo —> So —> n-o ~o h ■ 

This implies 

e ► / 0 ► ,g 0 ► ft . 

Then by the transitivity of Q/^'q we get 

e' ^> ft'. 

In this case we can thus replace the fragment (45) by this edge. 

Applying the above steps repeatedly, we can ensure that the path does not have 
fragments of the form (45), which means that (e^, / 0 ) € sOqU((so 0 )*; (Q/~ 0 ); (so 0 )*). 

■ 

Proposition C: so 0 U (Q/~' 0 ) is acyclic. By Proposition B and the facts that so 0 and 
Q/~o are transitive and irreflexive, if there is a cycle in so' 0 U (Q/~o)> tnen it can be 
converted into the form 

e' /' e>. 

If e' ~' 0 /', then e' % /' and, hence, /' S °° lgQ<go) > e'. The latter implies /' % e', 
which yields a contradiction with the acyclicity of <3/~o- 



Now assume e' /' 



'. Then for some e' Q , f 0 G E' 0 we have 




This implies 




which yields a contradiction as above. 



Proposition D: ft- 1 {(so' U (i?/~')) + ) = lib(((so 0 U vis 0 )/~ 0 ) + ) - sameop, where 
sameop = {(e, /) | /3(e) = /3(f)}. By Proposition B we have: 



/ 3- 1 ((so'U(i?/^')) + ) 
= p-\(so> u (lib'(K u (Q/^))+)/~')) + ) 

= r 1 (iib'((s 0 ; ) u(o/^))+)) 

= r 1 ((so^U(Q/^))+) 

= r 1 (so( ) U((so( ) )*;(g/^);(so( ) )*)) 

= !3-\so') U r^Cso'o)*; ((A)(((soo U vis 0 )/~ 0 ) + ) - id)/~' 0 ); (so' 0 )*). 



/T^so') = /S-^so'I^b)) = /T^so) - id) = so - sameop. 



/T^K)*; ((/3 0 (((so 0 Uvis 0 )/^o) + )-id)/^); (so' 0 )*) = lib(((so 0 Uvis 0 )/~o) + )-sameop. 
Take (e, /) G lib(((so 0 U vis 0 )/~ 0 ) + ) - sameop. Then 

(/9(e), £(/)) G /9(lib(((soo U vis 0 )/~ 0 )+) - sameop) = /?(((so 0 U vis 0 )/~ 0 ) + ) - id, 



(e, /) G /T^K)*; ((A)(((soo U vis 0 )/~ 0 ) + ) - id)/~{,); (so 0 )*). 



(/?(e), /?(/)) G (so' 0 )*; ((A)(((soo U vis 0 )/~ 0 ) + ) - id)/~' 0 ); K)*. 



We have: 



We now show 



which implies the required. 
Now take 



Then 



Hence, for some e' Q , f' Q G E' 0 



we have 



/3(e) 



Oo(((sooUvi5o)/~o) + )-id)/~d v , (sod)" 



*/?(/)• 



0 



76 



Assume 



q; then 



Therefore, for some e 0 , /o € -E such that /3(e 0 ) = e' Q and /3(/ 0 ) = To we have 



This implies 



(so 0 )* ((so 0 Uvis 0 )/~o) + , (so 0 )* 

e > e 0 > f 0 > f. 



((5O 0 Uvis 0 )/~ 0 ) + , 

e > /. 



By Proposition C we have /3(e) ^ (3(f), which, together with the above, establishes the 
required. 

Consider now the case when e' 0 f 0 . Then for some e[ ,f[&E' Q we have 

Of \ ( 5 °o)\ I I I ^o(((50 0 Uvis 0 )/~o) + ) ,, I ,, (sOq)* „ , 

P( e ) ► e o ~o e i ► A ~o To > PU) 

and ei /(. 

If /3(e) ~' 0 e' 0 , then /3(e) (5 °° n ^> > /3(e) ~ 0 e[. 

If /3(e) e 0 , then /3(e) ^ e' 0 and /3(e) (so ° n *-< E °>> ^ ^ 

We can make a similar argument for (3(f) and /p. Thus, for some e' 0 , f' Q € E' 0 we 
have that 

Of \ ( so o)*Uo(Eo), / / / /3o(((so 0 Uvis 0 )/~o) + ) ,/ , /»/ ( s °o)*l^o<Bo)^ off, 

P( e ) ► e 0 ~0 e i ► A ~0 To > P(f)- 

Then for some eo, ei, /o, /i € -E'0 we have 

/3(e 0 ) = eo ; /8(ei) = ei; P(fo) = fa (3(h) = fa 

(so 0 )* ((so 0 Uviso)/~o) + , , (so 0 )* 

e >■ e 0 ei >• ,/i ~ 0 Jo > 7, 



and ei 7^0 /i- This implies 



((so 0 Uvis 0 )/~o) + , 

e > /. 



By Proposition C we have (3(e) 7^ (3(f), which, together with the above, establishes the 
required. ■ 

Proposition E: so 0 Uar 0 /~ is prefix-finite. Assume there is e e E 0 such that the set 

We = {/ I / (s °° U3ro/ ~° )+ ; e} 

is infinite. Recall that so 0 partitions events in E 0 into finitely many sessions. Let U e 
be the set of events in the same session as e. Since soo is prefix-finite and Xq satisfies 
CausALAr, we can assume without loss of generality that W e fl £7 e = 0 and for every 
/ € W e there exists e/ £ U e such that 

((so 0 Uar 0 /~o)n(So-;7c) 2 )* (ar 0 /~o) 

7 ► e/ > e. 

Since ar 0 is prefix-finite, the set {e/ | / € W^} is finite. Hence, there exists e/ 0 such 
that 

{/ I / > e /ol 



is infinite. Continuing repeatedly as above, after finitely many steps we can eliminate 
all the sessions except one, which contradicts the prefix-finiteness of so 0 . ■ 

Proposition F: (X, /3 _1 (0°o u (R/~')) + ) l=ccs F. We first show that X satisfies the 
required axioms using the fact that X a |=cc F 0 . 

- CausalVis'. Consider 

(e,/) 

e ((soUvisU/3- 1 ((so^ ) U (i?/~')) + ))/H + nsameobjpf) 

= ((so U vis U (lib(((so 0 U vis 0 )/^o) + ) — sameop))/^)+ n sameobj(A") 

C ((soo U vis 0 )/^o) + H sameobj(X 0 ), 

(we used Proposition D). Then by CAUSALVIS for X 0 we have (e, /) <E vis 0 . We 
also know obj(e) = obj(/) £ L, so that by (43) we get (e, /) £ vis. 

- CausalAr'. Using Proposition D, we get: 

((soUarUr 1 ((so^W~'))+))H+ 
= ((soUarU lib(((so 0 U vis 0 ) /~ 0 ) + ) - sameop)/~) + 
C ((so 0 Uar 0 )/-o) + . 

Hence, the validity of CausalAr for X 0 implies the validity of CausalAr' for 
X. 

- PrefixFiniteAr'. We need to show that (so U ar U /3 -1 ((so' 0 U (R/~')) + j)/~ is 
prefix-finite. It is sufficient to prove that ((so U ar U /3~ 1 ((so' 0 U (R/~')) + ))/~) + 
is prefix-finite. Above we showed that 

((so U ar U /T X (K U (R/ ~')) + ))/~) + C ((so 0 U ar 0 )/~ 0 ) + , 
which is prefix-finite by Proposition E. 

Let us now show that X \= F. Consider e £ E; then obj(e) £ L and, in particular, 
obj(e) 7^ io. From (43) it follows that ctxt(X 0 , e) = ctxt(X, e) and 

rval(e) = rval 0 (e) = F 0 (obj 0 (e))(ctxt(X 0 , e)) = F(obj(e))(ctxt(X, e)), 

as required. ■ 

Proposition G: U so') is prefix-finite. Similarly to how it was done in Propo- 

sition D we get 

((#/-') U so')+ = so' 0 U (K)*; (Q/~' 0 ); (so' 0 )*). 
Since sOq is prefix-finite, it is sufficient to show that for any e, the set 

{/ I / ^ e} 

is finite. Since Q = /3 0 (((so 0 U vis 0 )/^o) + ) - id, this follows from Proposition E. ■ 



From Propositions C, F, G and (44) we then get X' |=ccs [ w >-> F] an d 

(l3,l{C 0 } oe o}(obj)):X^X'. (46) 



Let 

visp = client(viso) U ((so' U (/3(vis) - id) U i?)/~')+; 
ar(, = client(ar 0 ) U ((so' U (/?(ar) - id) U R)/~') + ; 
X' 0 =(^,vis' 0 ,ar( ) ). 

Proposition H: For S = /3 0 (((so 0 U ar 0 )/^ 0 ) + ) _ id, 

- S/~' 0 is transitive; 

- (so' 0 U = so' 0 U ((so' 0 )*; (S/~' 0 ); (so' 0 )*); 

- sOq U (<S/'~o) & acyclic. 

Proved the same way as Propositions A, B, C. ■ 

Proposition I: X' 0 e Exec, X' 0 |=ccs ^'o an d X' 0 satisfies the following version of 
Eventual: 

Ve € E'obUe) ^ uj => 

vis' (47) 
-i(3 infinitely many f <E Sq. sameobj(XQ)(e, /) A -i(e — ^> /)). 

Since ar 0 and X' .ar are prefix-finite, we have that so is ar' 0 . We now show that X' 0 
satisfies the required axioms. 

- CAUSALAR. We have: 

((so' 0 Uar^/~' 0 )+ 
= ((sod U client(aro) U ((so' U (/3(ar) - id) U i?)/~') + )/~o) + 
= ((so[,U^o(client(aro))U 

((so' U (/?(ar) - id) U 
lib'((so& U ((A)(((soo U vis 0 )/~ 0 ) + ) - id)/~' 0 ))+))/~') + )/~o) + 
C so' 0 U ((A,(client(ar 0 )) U (/3 0 (((so 0 U ar 0 )/~ 0 ) + ) - '^))h' 0 ) + 
= (so' 0 U ((A)(((soo U ar 0 )/~ 0 ) + ) - id)/~' 0 ))+. 

Let 

5 = /3 0 (((so 0 Uaro)/-o) + )-id. 

It is thus enough to show that the relation SOq U {S/~' q ) is acyclic. This follows 
from Proposition H. 

- CausalVis. We need to prove 

((so' 0 U viSo)/~o) + n sameobj(A"o) C v\s' 0 . 



Using Proposition B we obtain: 
vis o 

= client(vis 0 ) U ((so' U (/?(vis) - id) U R)/~') + 
= client(vis 0 ) U ((so' U (/?(vis) - id) U 

lib'((so' 0 U ((A)(((soo U vis 0 )/~ 0 )+) - id)H,))+))/~')+ 
= client(vis 0 ) U ((lib'((so' 0 U ((/3 0 (((so 0 U vis 0 )/~ 0 )+) - id)/~£,))+))/~') + 
= client(vis 0 ) U lib'((so' 0 U ((A)(((soq U vis 0 )/~ 0 )+) - id)/~(,))+) 
= client(viso) U lib'(so'o U ((so(,)* ; ((/3 0 (((so 0 U vis 0 )/~ 0 ) + ) - id)/~{,); (so{,)*)); 

((so{,Uvis{ ) )/~' 0 )+ 
= ((so[) U client(viso) U 

lib'((so' 0 U ((A)(((soo U vis 0 )/~ 0 )+) - id)H,)) + ))/~o) + 
C ((sof, U client(viso) U (so^ U ((/3 0 (((s°o U vis 0 )/~ 0 ) + ) - id)/~' 0 )) + )/~o) + 
= (sof, U ((A)(((so 0 U vis 0 )/~ 0 ) + ) - id)/~' 0 ))+. 
= so^ U ((so' 0 )*; ((A)(((soo U vis 0 )/~ 0 ) + ) - id)/~' 0 ); (so' 0 )*). 
Hence, we need to show 

(so^U((so^)*;((/3o(((so 0 Uvis 0 )/^o) + )-id)/^);(so^)*))nsameobj(^)C 
client(vis 0 ) U lib'(so'o U (K)*; ((A)(((soo U vis 0 )/~ 0 )+) - id)/~{,); (so{,)*)). 
Let 

(e' ; /') e (so' 0 U ((so' 0 )*; ((/3 0 (((so 0 U vis 0 )/~ 0 )+) - id)/~{,); (so{,)*)) 
n sameobj(Xg). 

Then either e' , /' e E' or e', /' G E' a — E' . The former case is obvious. Consider 
the case when e', f G E% - E' . If (e', /') e so' 0 n sameobj(X^), then (e', /') e 
so 0 n sameobj(Xo) C vis 0 , and thus (e', /') e client(vis 0 ). The remaining case is 
that 

(e' ; /') e ((so' 0 )*; ((A)(((soo U vis 0 )/~ 0 )+) - id)/~' 0 ); (so' 0 )*) n sameobj(^). 
As in the proof of Proposition D, we can show that this implies 

, ((5O 0 Uvis 0 )/~ 0 ) + i ,/ 

e > f . 

and, hence, 

(e', /') e ((so 0 U vis 0 )/- 0 ) + n sameobj(Xo) C vis 0 , 

as required. 

- (47). Assume that for some e e E' 0 such that objg(e) 7^ to we have 

3 infinitely many / € sameobj(Xg)(e, /) A ->(e -^A /). 

Then all /s are in E 0 — E and, correspondingly, -i(e /), yielding a contradic- 
tion with Eventual for X 0 . 



Finally, let us show that X Q \= ¥' 0 . Consider e e E' Q such that obj 0 (e) 7^ io. 
Given (43), it is easy to see that ctxt(X 0 ,e) = ctxt(X 0 ,e), if obj 0 (e) 7^ uj, and 
ctxt(X 0 , e) = ctxt(X', e), otherwise, from which the required follows. ■ 

Proposition J: There exists X 0 ' e Exec such that 

Xj'KcFo A X 0 \H = H 0 A X^vis D X 0 .vis A Xj'.arDlJ.ar. 



By Proposition I we have X' Q |=ccs ^'0 an d (47). Hence, the following holds for 

Y = X' 0 : 

Y hccs K A Y.H = H'q A F.vis D X Q .v\s A F.ar D X 0 .ar (48) 

A ^|{e|obj[,(e)^} = X'o\{e\obi' a (e)^u,y, 

\/eeE 0 .ob) 0 (e)^w => (49) 
-i(3 infinitely many / e E' Q . sameobj(X 0 )(e, /) A -i(e F ' v ' s ) /)); 

(/?, [{C 0 } oe0 ](o6i)) : A" F| {e |obji(e)= w }- (50) 

Consider an arbitrary execution Y satisfying these conditions. If Y satisfies EVEN- 
TUAL, then we can let Xq = Y. Otherwise, there exist events e <E E' Q such that 

3 infinitely many / e E' 0 . ob Jo (e) = obj' 0 (/) A -.(e /). (51) 

From (49) it follows that for all such events e we have obj 0 (e) 7^ to. Out of all events e 
satisfying (51), let us take an event e 0 that is minimal in ((so 0 U F.vis) / ^' 0 ) + , i.e., such 
that there does not exist an event eeEj for which (51) holds and 

((soJ,uy.vis)/~{,) + 

e > e 0 . 

Let 

Jo = {e | e <~ 0 e 0 A (51) holds}; 
J = {/ e E' 0 I 3e e J 0 - obj'o(e) = obj' 0 (/) A -n(e ^> /)}. 

As in Proposition E, we can show that ((so 0 U Y.ar)/^ 0 ) + is prefix-finite. Hence, there 
are at most finitely many / e J such that 

((sojuy.ar)/~i) + 

de e J 0 - J >• e. 

Let Ji be the subset of J resulting from removing all such / as well as all / such that 
/ e 0 ; then J\ is infinite. 
Next, let 

G = {eeE' 0 \e ^°'° uYV '^ + > 6f) V (e ^ 0 e 0 A e ^ J 0 )}; 



then G is finite and (51) is false for every e <G G by (47) and the choice of eo and Jo- 
Let 

G' = {g € E' Q | 3e € G. obj' 0 (e) = obj 0 (g) A -n(e ^> <?)}; 
then G" is finite. Hence, there are only finitely many f G J\ such that 

3. 9 EG'./ (K^V')/~o) + u~i, g- 

Let J 2 be the subset of J\ resulting from removing all such /. Then J 2 is infinite. 

Since Y.v\s D Xy.vis D /3(vis) and X satisfies EVENTUAL, there are at most finitely 
many / e J 2 such that obj(^- 1 (/)) f~l obj^"^ J 0 )) 7^ 0. Let J' be the set of such / 
and 

h = .h- {/' I 3/ € J'. /' «^™')/~» + "~° } /} . 

Then J3 is still infinite. Finally, take some element e e J3 that is minimal in ((so 0 U 
Y.vis)/~ 0 )+ i.e., 

^de GJ 2 .e > e. 

Let 

■h = Js - W I e ~ 0 e'}. (52) 
To summarise, J 4 includes all but finitely many / e E' Q such that 

de e Jo- obj'o(e) = obj' 0 (/) A -n(e ^> /) 
and for any / e J 4 we have: 

obj(/3- 1 (/))nobj(r 1 (Jo))^0; (53) 

-(/ ~o eo); (54) 

((so' 0 UY. ar ) + 

^de e Jo- J > e; (55) 



Ve, g e tf 0 . (obj'o(e) = obj 0 ( 3 ) A (e ^I^Z^ 6q v (e ^ e 0 A e ^ J 0 )) 

(56) 



A / > g) e > 3 . 



Let 



L/ = {(e, /) I e e J 0 A / e J 4 A obj 0 (e) = obj' 0 (/)}. 
Y' = (H' 0 , y.vis U U, (Y.ar U £/)+)• 

We now show that Y' |= C cs F 0 . We start by showing that Y' satisfies CausalAr. 
Assume there is a cycle in 

(so 0 U(Y.arUC/)+)/~ 0 . 

Then there is also a cycle in 

(so 0 U F.arU£/)/~ 0 . 



Since Y \=ccs F 0 , the cycle has edges from U/~' 0 . Without loss of generality we can 
assume that there is a single such edge on the cycle (the cycle can be transformed to 
ensure this), so that the cycle is of the form 

, U/~' 0 , ((soJ,uy.ar)/~{,) + , 

e > ./ > e 

for some e', /' € E' 0 . Then by (54) we have 

((so' 0 UY.zr)/~' 0 ) + 

./ > eo 

for some / € J4, which contradicts (55). Hence, Y' satisfies CAUSALAR. 

We now prove that Y' satisfies CAUSALVlS. Consider e, g e E' 0 such that 
objo(e) = obj 0 ( 3 ) and 

((so^uy.visu;7)/~^+ 
e > g. 

If the path from e to g contains only edges from (so 0 U F.vis) / ~ 0 , then, since Y satisfies 
CAUSALVlS, (e, g) e F.vis and we are done. Now assume that the path contains edges 
from f/~d . Without loss of generality we can assume that there is a single such edge 
on the path, so that the path is of the form 

((so^ur.vis)/-^)* , u/~' 0 , ((so^uy.vis)/-^)* 
e > e ► ,/ > g 

for some e', f e E' 0 . Hence, we have 

((so^uy.vis)/~i)* , 1 a u ,n ((so^uy.vi5)/~^)+u~i 
e > e ~ 0 e — > / ► .g 

for some e" e J 0 and /" e J 4 . If e e', then the above implies 

((so' 0 UY.v\s)/~' 0 ) + 

e >• e 0 

and by (56) we have (e, 5) € Y.vis. If e ^ 0 e' and e 0 Jo, then by (56) we again get 
(e, g) G Y.vis. The only remaining case is e e J 0 , so that 

, „ E7 ,// ((soJ,uy.vis)/~J,) + U~J, 

e ~ 0 e — > / > 9- 

Assume (e, g) £ F.vis. We show that g e J4, so that (e, <?) G U C Y' .vis. This follows 
from the following claims: 

- We cannot have <y ^ 0 eo. For in this case we would have 

/ // E/ hi ((soiuy.vis)/~i) + u~i , 
eo ~ 0 e / > 9 ~o e o- 



By (54), this implies 
which contradicts (55). 



„ ((so^uy.vis)/~^) + 

./ > e 0 , 



- We cannot have 

((so^uy.ar)/~^)+ „, 

.9 > e 

for any e'" e Jo- For in this case we would have 

,„ , „ U pi i ((so' 0 UY.v\s)/~' 0 ) + U~' 0 ((so' 0 \JY.ar)/~' 0 ) + ,„ 

e ~ 0 e — ► } > g > e 

By (54), this implies 

„ ((so^uy.vi5)/~^)+ ,„ 
J > e , 

which contradicts (55). Hence, g £ J\. 

- There cannot exist e\, e 2 such that 

((so'«UY.vis)/~> a )+ , 

(d > e 0 V (ei <~ 0 e 0 A e 1 £ J 0 )J A 

obj 0 (ei) = obj 0 (e 2 ) A -.(ei > e 2 ) A g > e 2 . 

For in this case we would have 

„ ((soiur.vis)/~i)+u~' ((so{,ur.vis)/~i)+u~' 
J >.9 > e 2 , 



which implies 
Hence, 



„ ((soiur.vis)/~i) + U~' 

/ > e 2 . 



, ((so'uY.vis)/~') + , , , 

(ei — e 0 V (d ~' 0 e 0 A ei ^ J 0 )) A 

obj 0 (ei) = obj 0 (e 2 ) A -.(ei ► e 2 ) A / > e 2 . 

which contradicts /" e J4. Hence, g e J 2 . 
Since 

((soiuy.vis)/~^) + U~i „ 

./ ► .9 A ./ e J 4 , 

we also have g e J 3 and g e J4. This shows that Y' indeed satisfies CAUSALVlS. 
Finally, from (53) and (50) we get that 

08, l{C 0 } oe0 j(obj)) : X -+ Y'\ {e]oK(e)=bj} . 

From this and Y \= ¥' 0 , by Corollary 34 and Lemma 35 we get Y' \= ¥' Q . 

We have thus shown how to convert an execution Y satisfying (48) and (49) into 
an execution Y' satisfying the same properties, but containing fewer events invalidating 
Eventual. Continuing this ad infinitum, in the limit we obtain the desired X' 0 ' . In 
particular, the prefix-finiteness of X' Q ' .vis and X Q '.ar is ensured by the removal of finitely 
many elements from J 3 in (52). ■ 



By (42) we have H' Q G (Pg)obj' 0 ; therefore, by Proposition J, X({ G 
[-Pc1([]j °bj'o^b)- We have also previously established observ(_ff 0 ) = observ(i?Q). 
We have thus shown the following: 

Vo6j 0 : (dom(Zi) U {x io } U { Xj \ j = l..m}) ^ inj Obj. 
VF 0 : (range(o6j 0 ) - {io}) -> Spec. 

G Obj - range( O 6 ?0 ). (obj 0 (x ]o ) = io) A (Vj = l..m.¥ 0 (obj(xj)) = [!}][]) => 
VX 0 e[P c 1 ]([] ) o6i 0) Fo).3X^. 

*0 e[^c]([],O&j 0 | O Var-{x 3 ^^ 

A observ(X 0 .#) = observ(X£'.i2"). 
It is easy to see that this implies the statement of Theorem 42. □ 

D.5 Completeness 

Let us again fix an object variable environment {xj : Oj \ j = l..m} and a collection 
of commands 

{xj : Oj | j = l..m} | v in ,v out h C a , o G O. 

LEMMA 43 Consider executions X, X' , X' 0 , Y', object uj and abstraction (/3, p) such 
that 

X' = -^ol{e|X£.obj(e)=w} A Y' = ^ol{e|^.obj(e)#w} A IJ H F'.E = 0 A 

Xobj(X.E) n ^.obj(^.S) =0 A (/?, p) : X X' . 

Let 

X 0 = {{Y'.E W y'. label W X. label, 

y'.so U X.so U {(e, /) | ee Y'.E A / G X.E A (e, /?(/)) G A^.so} U 

{(e, /) | e G I.£ A / G Y'.E A (/3(e), /) G X' 0 .so}, 
Y' .~ U X~ U {(e, /) | e G A / G X.E A (e, /?(/)) G U 

{(e, /) | e G I.£ A / G Y'.E A (/3(e), /) G X' 0 .~}), 
y'.visUX.vis,y'.arUXar). 

(57) 

7f X' 0 and X are causally consistent, then X 0 is a causally consistent execution. 

Proof. We first show CausalAr. Then it is easy to check that X 0 is indeed an exe- 
cution. Let (3' : X 0 .E — ¥ X' 0 .E be defined as follows: 

/3' (e) = (if e G X.E then /3(e) else e). 

From (/3, p) : X — > A" and the constraint on p in the assumptions of the theorem, we 
get that for all e, / G X 0 .£> 

(e,/)GX 0 .ar => (/3'(e), /?'(/)) G X^.ar U (id n (X'.£) 2 ); 
(e,/)GX 0 .so => (/3'(e), /?'(/)) G^.soU (id n(X'.S) 2 ); 
(e,/)eX 0 .~ (/?'(e),/3'(/))G^.~. 



Hence, 



Ve, /. (e, /) G (X 0 .so U X Q .ar)/(X Q .~) (58) 
=> (/?'(e), W)) e (^-so U X£.ar)/(^.~) U (id n (X'.£) 2 ). 

Assume there is a cycle in (X 0 .so U X 0 .ar)/(X 0 .^). Consider first the case when 
/?' maps all events on the cycle to the same event in X' 0 ; then all of these events belong 
to X.E. Consider two adjacent events ejelon the cycle. Since (5(e) = (3(f), we 
have (e, /) £ X.<~ and e and / must be related by X.so. But then (e, /) e X.so U X.ar 
and, since X is causally consistent, it must be that (e, /) € X.so. Thus, the existence 
of the cycle contradicts the acyclicity of X.so. 

If (3' maps at least two events on the cycle to different events in X' 0 , then (58) 
implies that (3' maps the cycle to one in (X^.so U X 0 .ar) / (X 0 .~), contradicting causal 
consistency of Xq. 

We now show CausalVis. Consider (e, /) G (X 0 .soUXo.vis)/(X 0 .<~ )■ Similarly 
to the above, we can show that either 

(P'(e),/3'(f)) G (X' Q .soU X^\s)/(X' Q .^) 

or P' '(e) — /?'(/) and (e, /) g X.so. Now consider 

(e 0 ,/o) G ((X 0 .soUX 0 .vis)/(X 0 .-)) + Asameobj(X 0 ). 

Then either 

(/3'(e 0 ),/3'(/ 0 )) G ((X£.soUX£.vis)/(^.~))+Asameobj(^) 

or P'(eo) = f3'(fo) and (eo, /o) G X.so. In the latter case we have (eo, /o) G X.vis 
since X is causally consistent. In the former case we get (/3'(eo), P'(fo)) G Xp.vis since 
X' 0 is causally consistent. If (3'(e 0 ), (3'(f 0 ) G K'.S, then (e 0 ,/ 0 ) '= (/3'(e 0 ), /3'(/o)) 
and (e 0 ,/o) G X 0 .vis. If /3'(e 0 ), /3'(/o) G X'.-E, then (/3,p) : X X' implies 
(e 0 ,/o) G Xvis C X 0 .vis. 

Finally, EVENTUAL for X a trivially follows from EVENTUAL for X and X' 0 . □ 

Lemma 44 Let 

\$ h let {xj = new Tj} j=1 „ m in {o(w in ) : v out = atomic {C 0 }} oe0 : 0}[] = F 

and consider X' G Exec(w) smc/i f/zaf X' |=cc ^ F\. Further, consider obj G 
\{ x j I i = l- m } — Obj] ana? fef F G [range(o6j) — > Spec] fee smc/z //zaf Vj = 
1..TO. F(o6j(x :) )) = T/ien there exists X G Exec such that X |=cc F and 

((3, l{C 0 } oe0 }(obj)) : X -+ X' for some /?. 

Proof. We construct the required execution X as a limit of a sequence of executions 
constructed for fragments of X' . 

Consider a finite set of events E C X'.E that is closed under X'.so -1 and X'.ar -1 
and let Y' — X'\e- It is easy to see that Y' |=cc [w h> Fj. Assume we have constructed 
Y G Exec such that 

(J3o,p):Y^Y' A K hcc F 



for some /3 0 . If Y' = X', we are done. Otherwise, let us choose an event e 0 G X'.E—E 
that is minimal in X'.so U X' .ar, i.e., 

-de G X .£7 - E. e > e 0 . 

Let Xq = X'\ EU { eo y, then X' 0 \=qq [cj i-> F]. Note that e 0 that does not have succes- 
sors in Xq.so U Xg.ar. We now construct X 0 G Exec such that 

(A),p) :^o^^o A XohccF. 

Let p = I{C* 0 } oe0 ](o&j), iV = ctxt(X^, e 0 ) and a = J^.rval(e 0 ). Since X£ hcc 
[lo F], we have F(N) — a. Therefore, by Propositions 17 and 20, we get 

3/3, Z, Z'. (JV, e 0 ) t —^Z'A(/3,p) : Z ^ Z' A Z \=cc F A a = Z'.rval(e). 

Let W = ZV.b and = Z^-i^.e). From (/3, p) : Z Z' and Z ^cc F it 
follows that 

(P\ f3 -i(N.E),p):W 1 ^W' A T^hccF. 

Let 

^ V ' S I /3o 1 ( N. E) ' ^ ar 1 0" 1 (JV. E) ) • 

From (/3 0 , p) : Y -> Y' and Y |= cc F it follows that 

(ftl/j-i^.p): Wb-MT A W 2 \=ccK. 
Then by Theorem 19 we get that W 2 ~7r W\ for some 7r : W 2 .E ^bij W\.E such that 

V/ef2.£A(/)=W/)). 

Without loss of generality we can assume that YE n Z.E = 0. Let 

X Q = 

{(YE W /S-^eo), Klabel W Zlabel^-i^), 
F.soUZso|^-i (eo) U{(e,/) | e G Y£ A / G /?" ^eo) A (/3 0 (e), e 0 ) G X^.so} 
Y~ U Z.-l^-!^) U {(e, /) I e G F.£ A / e r^eo) A (/3 0 (e), e 0 ) G U 

{(e,/) | e G /3-Heo) A / G YE A (e 0 , #,(/)) € 
Y.vis U Z.vis|^ 1(eo) U {(e, /) | e G ^ 2 .£ A / e ^\e 0 ) A (7r(e), /) G Z.vis}, 
J2+), 

where 

J2 = Y.ar U Z.ar\ p -i {eo) U {(e, /) | e G W 2 .E A f G /^(eo) A (7r(e), /) G Z.ar} 
U {(e, /) | e, / G ^ 2 .£ A (7r(e),7r(/)) G W^.ar}. 

Let /?' : X 0 .E -> X' 0 .E be defined as follows: 

/3' (e) = (if eeY.E then /3 0 (e) else e 0 ). 



We first show /3'(X 0 .vis) - id C X' 0 V\s and P'{X 0 .ar) - id C X 0 .ar. Since (/3 0 ,p) : 
y — > V , we have 

P'(YV\s) - id C y'.vis C J^.vis. 
Now consider e € W 2 -E and / G /3 _1 (eo) such that (7r(e), /) G Z.vis and 

A,(e) = /3'(e) ^ /?'(/) = eo. 

We have 

(p(n(e)),p(f)) = (p Q (e),e Q ). 
Then since p) : Z — > Z', we get 

(/3'(e), /?'(/)) - (A)(e), eo) € Z'.vis C A>is. 

This shows /3'(X 0 .vis) — id C Xp.vis. We can similarly show /3'(X 0 .ar) — id C X' n .ar. 

We have (/3',p) : X 0 .H -> -X^.i? by the construction of X 0 . To show (/3',p) : 
X 0 — > it remains to establish /3' _1 (Xq. vis) nsameobj(Xo) C Jf 0 .vis. Since (Po,p) : 
y -> y' , we have 

(y'.vis) n sameobj(y) C y.vis C X 0 .vis. 

Now consider 

efeY'.E, eePo 1 (e!)CY.E, f G /T^eo) C Z.£ 

such that (e', eo) € A^.vis and y.obj(e) = Z.obj(/). We need to show that (e, /) G 
Xo.vis. Since (e',eo) G A^.vis, we have e' € Z'._E, so that (e',eo) € Z'.vis. Then 
7r(e) G Z.E 1 . Since Wi & n W 2 , we have 

(^(7r(e)),/3(/)) = (A)(e),e 0 ) = (e',e 0 ) G Z'.vis 

and 

Z.obj(7r(e)) = y.obj(e) = Z.obj(/). 

Taking into account ((3, p) : Z — > Z' we get (7r(e), /) G Z.vis, which implies (e, /) G 
X 0 .vis, as required. Hence, (/?', p) : X 0 .i? -> X' Q .H. 

We now show that A" 0 satisfies CAUSALAR and CausalVis, similarly how we 
proceeded in the proof of Lemma 43. This implies that X 0 is an execution. 

Since (/?', p) : X 0 -> X' Q , for all e, / G X 0 .E: 

(e,/)GX 0 .ar => (/?'(e), /?'(/)) G X 0 .ar U id; 
(e,/)el 0 .so => (/3'(e), /?'(/)) G^.soU id; 
(e,/)GX 0 .~ (£'(e), /?'(/)) € X 0 .~. 

Hence, 

Ve,/. (e,/) G (X 0 .soUX 0 .ar)/(X 0 .~) 

=► (/3'(e), /?'(/)) G (X 0 .soUX 0 .ar)/(X 0 .~)Uid. 



Assume there is a cycle in (X 0 .so U X 0 .ar)/ (X 0 .^). Then there is also a cycle in 
(Jfg.so U R)/(X Q .~). If (3' does not map all events on the cycle to the same event 
in Xq, then the above shows that (3' maps the cycle to one in (Xq.so U R)/(X' 0 .^), 
contradicting causal consistency of X' 0 . 

Consider now the case when /?' maps all events on the cycle to the same event 
e' GX' 0 .E. Consider (e, /) G (X 0 .soUi?)/(X 0 .~) such that /3'(e) = /?'(/) = e'. Then 
(e, /) G Xo.~. Hence, (e, /) G X 0 .soUR and either (e, /) G X 0 .soor(/, e) G X 0 .so. 
It is easy to see that we cannot have (e, /) G X 0 .so and (/, e) € AT 0 .so. Assume 
(e, /) G R and (/, e) G X n .so. If we had (e, /) G y.ar or (e, /) G Z.ar^-i^), then 
this would contradict the causal consistency of Y or Z. Hence, we can only have 

e,fe W 2 .EA(n(e),n(f)) e Wi.ar 

and (/, e) G F.so. Then X 0 .obj(e) = X 0 .ob](f) and, since y is causally consistent, 
we have (/, e) G F.vis and, hence, (/, e) G Y.ar. But, together with the above, this 
contradicts W 2 ~ x W\. Thus, we must have (e, /) G X 0 .so. In this way, we get a cycle 
in X 0 .so, which we cannot have by the construction of X 0 . We have thus established 
that X 0 satisfies CAUSALAR. Then CausalVis is shown as in the proof of Lemma 43. 

Finally, we prove that X 0 \— F. Consider e g Xq.E such that X a .ob\{e) g dom(F). 
First assume that e g Y.E. Since Y |= F and Y.ar C X 0 .ar, we have 

X 0 .rval(e) = K.rval(e) = F(F.obj(e))(ctxt(F, e)) = F(X 0 .obj(e))(ctxt(X 0 , e)), 

as required. 

Assume now that e g (3~ 1 (e 0 ). Since Z \= F, we have 

X 0 .rval(e) = Z.rval(e) = F(Z.obj(e))(ctxt(Z, e)) = F(X 0 .obj(e))(ctxt(Z, e)) 

We now establish a correspondence between ctxt(Z, e) and ctxt(X 0 , e). First, of all, 
we have ctxt(Xo,e).p = Xo.aop(e) = Z.aop(e) = ctxt(Z,e).p. We now show that 
there is a bijection between the events in these contexts. 

- Consider / g ctxt(X 0 , e).E. Then (/, e) g X Q .v\s and, hence, either / g W 2 .E 
and (?r(/), e) g Z.vis or / g /^Oo) and (/, e) g Z.vis. For / g ctxt(X 0 , e).£ 
let 

= (if / € VK 2 .£ then tt(/) else /). 

Then / g ctxt(X 0 , e)..E implies n'(f) g ctxt(Z.e)._B, so that 7r' : 
ctxt(X 0 , e)~E -> ctxt(Z, e).£. 

- Consider /' g ctxt(Z, e)~E. Then (/', e) g Z.vis and, hence, either /' g /3 _1 (e 0 ) 
and (/', e) g AT 0 .vis or /' g Wi.S and (Tr- 1 ^'), e) g X 0 V\s. Thus, if (/', e) g 
Z.vis then for some / G ctxt(X 0 , e).E we have 7r'(/) = /'. 

Hence, ir' is a bijection. 

Consider ctxt(X 0 , e).E C W2-E U /3 _1 (e 0 ). We have the following cases: 

- f,g G /3- 1 (eo)-Then 



(/, 5 )Gctxt(X 0 ,e).vis (7r'(/),^(.g)) = (.f,.g)GZ.vis. 



- / G W 2 .E and g G /? _1 (e 0 ). Then 

(/, ff )ectxt(X 0 ,e).vis (7r / (/),7r / ( 5 )) = ( 7 r(/), 5 )eZ.vis. 

- f,g e W 2 .E. Since W 2 ~,r Wi, we get 

(/,«;) ectxt(X 0 ,e).vis (ir'(f),ir'(g)) = (Tv(f),iv(g)) € Z.vis. 

Hence, 7r'(ctxt(X 0 , e).vis) = ctxt(Z, e).vis. 

We now prove a similar statement about arbitration. Consider (/, g) G dxt(Z, e) .ar; 
then f,gGWi.E\J /3 _1 (eo). We have the following cases: 

- f,g G /3- 1 (eo)-Then 

(tt'-V),^'- 1 ^) = (/,(/) G ctxt(X 0 ,e).ar. 

- / G Wi.E and 5 G /3 _1 ( e o)- Then 

(7r'- 1 (/)^'- 1 ( 3 )) = ( 7 r- 1 (/),.g)eX 0 .ar. 

-/,t(€ W1..E. Then 

(7r , - 1 (/),7r / - 1 ( 5 )) = (tt-^/)^- 1 ^)) G Xo.ar. 

Hence 7r _1 (ctxt(.Z, e).ar) C ctxt(Xo, e).ar. 

From the above correspondence between ctxt(Z, e) and ctxt(Xo, e) and the prop- 
erties of data type specifications, we get 

AT 0 .rval(e) = F(X 0 .obj(e))(ctxt(Z, e)) = F(X 0 .obj(e))(ctxt(X 0 , e)), 

which establishes Xo \= F. Hence, Xo \=cc IF- 

Applying the above construction of X 0 from Y ad infinitum starting with E = 0 
and empty Y and V, in the limit we obtain X G Exec such that 

CM A X|= CCS F 

for some /3 (in particular, the prefix-finiteness of X.ar follows from p) : X — > X'). 

We now show that X satisfies EVENTUAL, thereby establishing X \=cc IF- Assume 
Eventual does not hold, i.e., for some e G X.E we have 

3 infinitely many / G X.E. sameobj(X)(e, /) A -i(e ^' v ' 5 > /). 

Let {/fej^Lj be a set of such /s. Since for any / G P~ 1 (f) is finite, we can 

assume without loss of generality that /3(e) 7^ /?(/&) for any k and /?(/,) 7^ /3(/fe) for 
any j and k such that j 7^ fc. But then, since (/?, p) : X — > X', we have 

-(/3(e) ^> 0(/ fc )), 
for fc, which contradicts EVENTUAL for X'. □ 



Proposition 45 Assume 

A U {x : O} | E V- C; 
A U {xj : Oj | j = l..m} | S h sw&s£({(x, o) ^ C Q \ o e O}, C). 

Then 

Vo&j : dom(A U {x : O} U {xj : Oj \ j = l..m}) Obj. 
Vcr : Va\.VH,H'.V0 : H.E -> H'.E. 

(((/?, l{C 0 }oeoKobj\ {Xjlj=1 .. m} ), obj(x)) : H => H 1 ) A 

H' e (|CD(o67'|oVar-{x^j=l..m},CT)) 

H e <\subst({(x,o)^C 0 | oe 0},C)D(o6j|ov ar _ w ),tr). 

Corollary 46 AssMme 

0|Z\U{x:O}hP c ; 
0 | Z\ U {x 3 ■ : I j = l..m} h sw&st({(x, o)^C„|oe O}, P c ). 

77ze« 

Vo&j : dom(Z\ U {a; : 0} U {xj : Oj \ j = l..m}) -h nj Obj. 
\/H,H'.\//3 : H.E -+ H'.E. 

(((13, l{C 0 } oe0 l(ob ] \ {xAj=1 „ m} ), obj(x)) :H^H')A 

H' G (-Pc)(0&j|0Var-{x 3 b = l..m})) 

H € (subst({( X ,0) I— > C 0 | OG 0},Pc))(0&7'|0Var-{x}))- 

Theorem 47 (Completeness) Lef 

D = (let = new Tj} J= i.. m in {o(u in ) : w out = atomic {C 0 }} oe0 ); 
P 2 = (let x = new D in P); 

P 1 = (let {xj = new Tj-}j=i.. m in subst({(x, o) t-> C 0 \ o e 0},P)), 
where P 1 a«<f P 2 are complete. Then [P 2 ]cg C [P 1 ]cg- 
Proof. Let 

0|{x io :{ Oio }}UZ\U{x:O}hP 2 ; 
0 I {^io : {o io }} U4U {xj : Oj \ j = l..m} h P* 

be the client parts of P 1 and P 2 , respectively, so that 

Pi = subst({(x,o) i-> C„ | o € 0},Pc)- 

Consider any o&j'q : (dom(Z\)U{xj 0 , x : O}) — Obj such that o6jg(a;i 0 ) = ioand 
¥' Q : (range(o&/ 0 ) - {io}) -> Spec such that F^o^x)) = [£>][]. Let o&jo(x) = w. 
Further, consider any execution 

x' a eiPlj(l},obf 0 ,F< Q ). 



Then 

X' Q .H e(Pl)obj' Q A X 0 hccF 0 . 

Let X' = X 0 | {e | X ,. obj(e)=w} . Pick any obj : {xj \ j = l..m} -h nj Obj such that 
range(o6j) n range(obj' 0 ) = 0 and let F G [range(o6j) — > Spec] be such that Vj = 
l..m.¥(obj(xj)) = {Tj}[]. It is easy to check that X' 0 |= C c F„ implies X' \= cc 
[ui i — ^ ([£>][])]. Then by Lemma 44 there exists X and j3 such that X |= C c F and 
(/?, [{C 0 } oe o]( 0 ^j )) : X — > X' for some /?. Without loss of generality we can assume 
thatX.^nX^.E = 0. 

Let y' = ^ol{e|x^.obj( e )/w} and let Xq be defined by (57). Then by Lemma 43, X 0 
is causally consistent. Define 

obj Q : (dom(Z\) U {x ]o } U {xj \ j = l..m}) -h nj Obj; 
F 0 : (range(o6j 0 ) - {io}) -> Spec 

as follows: obj 0 (xj) — obj(xj) and obj 0 (x) = obj 0 (x) for all other x; Fo(cj') = F(w') 
fore/ G range(o6j) and F 0 (u/) = Fg(w') for all other u'. It is easy to see that X 0 \=¥, 
so that X 0 |= cc F. 

Let ft : X 0 .E -> X' 0 .E be defined as follows: 

/3'(e) = (if e G X.£ then /3(e) else e). 

From 03,[{C o } o6O ](o67)) : * ^ X ' * follows that (/?',!{ C 0 }o e o](°&j), w) : 
Iff X'.H. Then, since X 0 .ff G (Pl)obf 0 , by Corollary 46 we have X 0 .ff G 
(Pl)obj 0 . As we also have X 0 |=cc F, we get X 0 G [-P<;]([], 0&jo>F o ). Furthermore, 
observ(X 0 .ff) = observ(X 0 .ff ), as required. □ 

E Proof of the social graph data type and additional examples 
E.l Proof of the social graph data type 

We now prove that the data type from Figure 3 has the specification F soc from §5 as its 
denotation. Take any 

obj G {friends[a\, requesters[a] | a — 1..N} — >; n j Obj 

and let F = Acj. F RWset . Let p = l{C 0 } oe o} (obj), where O is the data type signature 
and C 0 are the commands from Figure 3. It is easy to check that for any context N over 
the data type operations we have j(N, p, ¥) ^ 0. We now prove that for any context N 
we have 

VX,c.(X,c)ei(N,p,¥) => c = F S0C (N) 

by induction on the size of N.E. Consider a context N such that \N.E\ = n and assume 
the above holds for all contexts with \N.E\ < n. Let 

N = (p, M), E' = N.E, aop' = TV.aop 

and vis' and ar' are as in Definition 7. 



Take (X, c) G 7(iV, p, F), where X = (H, vis, ar) = ((E, label, so, ~), vis, ar) (we 
also use derived selectors, such as obj). Then for some e 0 ^ E' and (3 we have 

{l3, P ):X^{N,e Q ,c)AX\=cc¥. 

Hence, for some {c/ G Val | / G .E'} we have 

(yfeE'.H\^- 1{f) G P (Bop'(f),c f )) A 
{H\f,- Heo) ep(p,c)) A /3(tf.so)Cid A 0(fT.~)Cid 

and(10)-(12) hold. 

From the induction hypothesis and Lemma 35 it is easy to establish 

VfeE , .c f = F aoc {ctet{M,f)). (59) 

We need to show that c = F soc (N). 

Let us first consider the case when p = get (a). Then we have: 

fst(c) = 

{b | 3e e E. obj(e) = obj (friends[a\) A aop(e) = add(6) A 

V/ G E. obj(/) = obj(e) A aop(/) = remove(6) =► / ^> e}; 
snd(c) = 

{b\3e& E. obj(e) = obj (requesters[a\) A aop(e) = add(6) A 

V/ G E.obj(f) = obj(e) A aop(/) = remove(6) =► / ^> e}; 
fst(F S0C (7V)) = 

{b\3e£ E'. (aop'(e) = accept((6, a) \ (a, &))) A F S0C (ctxt(M, e)) A 
V/ e E'. (aop'(/) G breakup((6,a) | (a, 6))) A F S0C {ctxt(M, ej) 

f — > e}; 

snd(F S0C (iV)) = 

{b\3e e E'. (aop'(e) = request (b, a)) A F soc (ctxt(M, e)) A 

V/ G E'. (aop'(/) G (accept | reject)((6, a) \ (a, &))) A F soc (ctxt(M, e)) 

. p vis' 

/ > e}. 

- Take 6 G fst(c). Then for some e E E we have 

(obj(e) = o&j(./Hen<fe[a]) A aop(e) = add(6) A V/ G £. obj(/) = obj(e) (60) 
Aaop(J) = remove(6)) / -^H> e. 

Then aop'(/3(e)) G accept((6, a) | (a, 6))), Cg( e ) = true and by (59), 
F S0C (ctxt(M, /3(e))) = true. Consider / G E' such that 

(aop'(/) G breakup((6,a) | (a, b))) A F S0C (ctxt(M, e)). 

Then / 7^ /3(e) and by (59) we have c/ = true. Hence, for some e' G E such that 
/3(e') = / we have 

obj(e') = o6j(/nends[a]) A aop(e') = remove(6). 



Then by (60) we have e' e. By (10) this entails / /3(e). This shows 

b g fst(F S0C (7V)). 

- Take 6 € fst(F S0C (/V)). Then for some eeB'we have 

(aop'(e) = accept((fe, a) | (a, 6))) A F soc (ctxt(M, e)) A 

V/ G E'. (aop'(/) G breakup((6, a) | (a, b))) A F S0C (ctxt(M, e)) (61) 

By (59) we get c e = true. Hence, for some e' G E such that /3(e') = e we have 

obj(e') = obj (friends[a\) A aop(e') = add (6). 
Consider / G E such that 

= obj(e') A aop(/) = remove(6). 

Then aop'(/3(/)) G breakup((6, a) \ (a,b)), c^/) = true and by (59) we have 
F S0C (ctxt(M,/3(/))) = true. Hence, by (61) we have /3(f) ^ /3(e'). Then 

by (1 1) we have / ^> e', which shows that b G fst(c). 

- Take 6 G snd(c). Then for some eeEwe have 

(obj(e) = o&j(regwesiers[a]) A aop(e) = add(fe) A V/ G E 1 . obj(/) = obj(e) 
A aop(f) = remove(6)) =£■ f ^ e. 

(62) 

Then aop'(/?(e)) = request(6, a) and cg( e ) = true. Also, by (59), 
F S0C (ctxt(M,/3(e))) = true. 

Consider / G E' such that 

(aop'(/) G (accept | reject)((6, a) | (a, b))) A F S0C (ctxt(M, e)). 

Then / 7^ /3(e) and by (59) we have cj = true. Hence, for some e' £ E such that 
/3(e') = / we have 

obj(e') = obj (requesters[a\) A aop(e') = remove(fo). 

Then by (62) we have e' e. By (10) this entails / /3(e)- This shows 
be snd(F S0C (iV)). 

- Take 6 G snd(F S0C (/V)). Then for some e £ E' we have 

(aop'(e) = request(6, a)) A F soc (ctxt(M, e)) A 

V/ G E'. (aop'(/) G (accept | reject)((6,a) | (a, b))) A F B0C (ctxt(M, e)) 

(63) 



Fig. 8. A shopping-cart data type. We use some syntactic sugar and a generalisation removeAll 
of the remove operation of AWset. 

^cart = let {items — new AWset; 

inline resolve(boofc) = { 

var entries — {(book,n) \ (book,n) £ items. get}; 

items, remove All (entries); return max({n | (_, n) £ entries} U {0})}} in { 
inc(6oofc, n) = atomic { var m = resolve(boofc); items. add(book, m + n) }; 
dec(book,n) = atomic { var m = resolve(boofc); 

if (to — n > 0) then items .add(book , m — n) }; 
count(book) = atomic { var m = resolve(feoofc); items, add (book, m); w out = m } } 



By (59) we get c e = true. Hence, for some e' £ E such that fi(e') =ewe have 

obj(e') = obj (requesters[a\) A aop(e') = add(b). 

Consider f £ E such that 

obj (/) = obj(e') A aop(/) = remove(6). 

Then aop' (/?(/)) £ (accept | reject)((6, a) \ (a,b)), cptf) — true and by (59) 
we have F B0C (dxt(M, /?(/))) = true. Hence, by (63) we have (3(f) ^ /3(e'). 
Then by (1 1) we have / ^> e', which shows that b £ snd(c). 

The above establishes c = F S0C (N). 

We now consider the case when p = accept(6, a); the others are analogous. We 
have 

-^soc 

(7V) = (6esnd(F soc (get(a),M))) 

and 

c = true •<=>• (Be £ E. obj(e) = obj (requester s[a\) A aop(e) = add(fe) A 

V/ £ E. obj(/) = obj(e) A aop(/) = remove(fe) =^> / ^> e). 

But we have already shown that the above is equivalent to b £ snd(_F soc (get(a), M)), 
as required. □ 

E.2 A shopping-cart data type 

The example appearing in Figure 8 implements a shopping cart for an online book- 
store. Conceptually, a shopping cart is a map from book titles to non-negative integers, 
representing the number of copies requested. The data type provides three operations: 
inc (book, n) and dec(book, n) for increasing or decreasing the count associated with 
a book by a positive integer n, and count (book) for querying the count (an operation 
giving the full cart contents can be implemented similarly). The cart can be accessed 
concurrently in different sessions, e.g., by spouses. This can lead to conflicts when the 



Fig. 9. (a) A context of the data type in Figure 8; and (b) an execution belonging to its concreti- 
sation. We use the same conventions as in Figure 5. 



Ial ( b ) cj get(/>) 0 

inc(6,2) inc(6,3) co.removeAll(0) 
<y.add((/>.2)) 



\co.qet(b): 0 

io).removeAll(0) 

io).add((6,3)) 



eo: count(i): 3 



f. co.get^{(b,2)r(b,3)} 

<w.removeAll({(Z>,2), (6,3)}) 
<w.add((2>,3)) 



count for the same book is updated concurrently, as in the context shown in Figure 9(a). 
Our implementation takes one possible choice of resolving such conflicts so that in- 
creases win against concurrent decreases or smaller increases; this results in customers 
buying more. Thus, its denotation returns 3 on the context in Figure 9(a). 

The implementation represents the cart using an add-wins set that stores pairs of 
a book ordered and the corresponding positive count. Multiple concurrent updates to 
the count of the same book result in separate entries (book, m), . . . , (book, n*;); see the 
event / in the execution in Figure 9(b), which concretises the context in Figure 9(a). 
To resolve such conflicts, an operation involving the book replaces the above entries 
by their maximum max{n 1; . . . , n k } (implemented by the macro resolve). Using an 
add-wins set to represent items is crucial for the correctness of our implementation: it 
ensures that removeAll in resolve removes only the entries it computes the maximum 
of; in a remove-wins set it would also cancel all concurrent operations. 

Below we prove that the shopping cart data type has the following specification 
-Peart as i ts denotation in our semantics. Informally, F cart applies the sequential se- 
mantics of shopping cart (formalised by the function G below) to all maximal paths 
of events in visibility in the context (where maximality is given with respect to the 
subsequence order) and takes the maximum of the results: 

F calt (inc(book,n),M) = F caxt (dec(book, n), M) = _L; 
F cart (count(6ooA;),M) = max({0} U {G(n, 0) | n is a 

maximal vis-path of events in M.E that operate on book}), 

where G(ir, m) are defined as follows: 

G(e, m) = m 

G(eir, to) = G(ir, max {0, to— n}) if M.aop(e) = dec(book, n) 
G(eir, to) = G(ir, m+n) if M.aop(e) = inc(book, n) 

G(eTT,m) — G(iT,m) otherwise 

Thus, F cart explains the outcome of operations in the distributed setting M in terms of 
their sequential executions consistent with visibility: the number of copies of book is 
the maximum possible value that can result from such executions. 



Proof of the shopping-cart data type. Let {C 0 } oe0 be the implementations of op- 
erations of the shopping-cart data type. We will prove that 

VJV. Ve. Vobj e [{items} ^ inj Obj]. VF. VX V/3. 
(e £ (N.E) A ¥(obj(items)) = F AWset A (fi, l{C 0 } 0 }obj) : X^(7V, e, _) A X hcc F) 

3e 0 € /3 _1 (e). ^-°P(e 0 ) = get A 

ybook. max ({0} U {n | (&00A;, n) G Xrval(e 0 )}) = F cart (contains(&oofc), N.M), 

(64) 

where 7V.M is the partial operation context of M (i.e., M except the first component of 
the applied operation). 

Before proving this implication, we show that it entails the correctness of our spec- 
ification F cart for the shopping-cart data type. Consider 

N, eg (N.E), obj e [{items} -s- inj Obj], F, X, (3, c e Val 

such that 

¥(obj{items)) = F AWset A (p, l{C 0 } oe0 \obj) : X ^ (N,e,c) A X |= cc F. 
We need to show that i^ C art 

(N) = c. By the definition of (/?, l{C 0 } oe0 jobj) : X —> 

(N, e, c), we have 

(X.H)[ 0 - 1{e) e [{C 0 } oe o]o6i(iV.p,c). (65) 

Recall that the shopping-cart data type implements only three operations, that is, those 
in O — {inc, dec, contains}. Hence, by the semantics of {C 0 } oe o, the set member- 
ship in (65) implies that for some nonnegative integers book 1 and n', 

(N.p = inc(book', n) A c = _L) V (N.p = dec(book' , n) A c = _L) 

V (iV.p = contains(feoofc')). 

It is easy to see that the desired F cart (N) = c follows in the first two cases. In the third 
case, we use (64) and deduce that 

3e 0 € /? _1 (e). X.op(e 0 ) = get A 

(max ({0} U {n \ (book 1 ,n) € Xrval(e 0 )}) = F cart (contains(6oofc'), N.Alfj . 

By (65) and the definition of I{C 0 } oe o] (in particular, the part for Contains), the LHS 
of the above equation is equal to c. But the RHS of the equation is precisely F cart (N). 
Hence, the above equation implies that F caxt {N) = c, as desired. 
We now go back to the proof of (64). Consider 

N, eg (N.E), obj e [{items} -t^ Obj], F, X, /3 

such that 

¥(obj(items)) = F Atfset A (0, l{C 0 } oe0 }obj) : X -> (N, e, _) 

A X hcc F. 



We should show that 

3e 0 e /3 _1 (e)- I.op(e 0 ) = get A 

(\fbook. max ({0} U {n \ (book, n) G A".rval(e 0 )}) = F cart (contains(&oo&), N.M)^j , 

where 7V.M is the partial operation context of TV. Note that in the implementation of 
all the operations of the shopping-cart data type, the macro resolve(6oofc) for some 
nonnegative integer book is run first, and this macro starts by calling the get operation 
of the items object. Furthermore, (X.H)\p-i/ e \ should describe the computation of 
one of such shopping-cart operations, because (X.H)\p-i^ G l{C 0 } oe o}obj(N.p, _). 
Hence, 

3e 0 e /? _1 (e). X.op(e 0 ) = get. 
It is sufficient to show that this e 0 satisfies the following property: 

\fbook. max ({0} U {n | (book,n) G Xrval(e 0 )}) = i^ cart (contains(6oofc), iV.M). 

(66) 

We will prove the following slightly more general fact. For every E' C (N.E) closed 
under TV.vis" 1 (i.e., N.\/\s~ 1 (E') C E'), if we let E' 0 = ^(E') and N' = N\ E ; we 
have that 

Vbook. F cart (contains (feoofc), N'.M) = (67) 
max ({0} U {n \ (book,n) G F AWset (get, E' 0 , Xaop| B ^, X.vis| E /, X.ar| s / )}). 

where N'.M is the partial context of TV'. Note that this implies (66) because 

E' 0 = p~\N.E) => ctxt(X,eo) = (get,^,X.aop| £ /,X.vis| Bj ,X.ar| B j). 

Our proof of (67) is based on the induction on the size of E' . The base case is that 
E' = 0. In this case, the RHS of (67) is 0. Also, since E' is empty, so is E' 0 = ^(E 1 ). 
Thus, F Atfset (get, . . .) on the LHS of (67) returns the empty set, from which follows 
that the LHS is 0. 

Next we handle the inductive case. Let E' be a nonempty iV.vis -1 -closed subset of 
N.E. Let 

E' 0 = /3~ 1 (E') and N' = N\ E >. 

Pick a nonnegative integer book. Let ir be a maximal vis-path of events in E' that operate 
on book and G(n) = F cart (contains(&ooA;), N'.M), if such ir exists. Otherwise, we 
set 7r = e, so that G(w) = F cart (contains(&ooA;), N'.M) even in this degenerate case. 

IfG(7T)=0, 

i^cart(contains(6oofc),iV'.M) = 0 < 

max ({0} U {n\ (book,n) G F AWset (get,£'o,Xaop|^,Xvis|^,X.ar|^)}). 

Otherwise, tt should be of the form n'f. Let 

E" = (N.v\s)- 1 (f), E'^=p-\E"), N" = N\ E „, E"' = E"u{f}, 
E%' = r 1 (E"'), and N'" = N\ E ,„. 



By the induction hypothesis, 

F cart (contains(&ooA;),iV".M) = 

max ({0} U {n \ (book,n) G i ;i AWset (get,£ , o,Xaop| J5 »,Xvis| s »,X.ar| E //)}). 

By the claim that we will show at the end of this proof, the above equality implies that 

f cart (contains(6oofc), N"'.M) = 

max ({0} U {n \ (book,n) G F AWset (get, , X.ao<p\ E n>, X.\i'\%\ E m , X.ar\ E m)}). 

Hence, 

F cart (contains (book), N'.M) 
= Gin) 

= F cart (contains(&ooA;), N'" .M) 

= max ({0} U {n \ (book,n) e ^ A wset(get, Eq , X.ao<p\ E >>>, X.\i\s\ E »> , X.ar\ E ^)}). 
< max ({0} U {n \ (book,n) G F AWset (get, -Eq, X.aop\ E ' 0 , XV\s\ E ^, Xar| E /)}). 

The last inequality holds because for every nonnegative integer n, 

(book,n) G F AWset (get,^",Xaop| E »/,Xvis| B «,Xar| B «) (68) 
=> (book,n) G F AWset (get,^,Xaop|^,Xvis|^,Xar| B <). 

This implication itself holds for the following reason. 7r'/ is a maximal vis-path 
of events that operate on book, so / is not TV.vis-related to any inc (book, .. .) 
or dec(book, . . .) events in E' 0 . This and the fact that (/3,l{C 0 } oe o}obj) : 
X — > (N,e,_) together ensure that all the uncancelled add( book, .. .) events in 
(E'q, X.aop\ E > o " , XV\s\ E ' o ",X.ar\ E ' o ") remain uncancelled in the bigger operation con- 
text (E' 0 , X.aop\ E > Q , X.v\s\ E i , X.ar\ E i ). From this follows the implication in (68). 
Now let n be the maximum of 

{n | (book,n) G i^ A wset(get, E' 0 , X.aop\ E < o , XV\s\ E > o , X.ar]^)}, 

if this set is not empty. Otherwise, we set n — 0. If n = 0, 

max ({0} U {n \ (book,n) G F AWBet (get, E' 0 , Xaop|^, -Y.vis| E j, X.ar\ E;> )}) 
= 0 

< -F C art(contains(6oofc), N'.M). 

Assume now that n ^ 0. Then, there exists / 0 G E' 0 such that X.aop(/o) = 
&dd(book, n) and f 0 is not (X.vis)-related to any event in E' 0 that removes (book, n). 
Let 

f = (3(f 0 ), E" = (N.yAs)- 1 (f), 1% = P~\E"), N" = N\ e „, 
E"' = E"u{f}, E'^p- 1 (E'"), and N"' = N\ E ,„. 



By the induction hypothesis, 
F cart (contains(&oo&), A/"".M) = 

max({0}U{m | (book,m) G F AWset (get, Eq , Xaop| B », XV\s\ E [,, Xar| B »)}). 
By the claim that we will show at the end of this proof, the above equality implies that 
F cart (contains(6ooA;),7V"'.M) = 

max({0}U{m | (book,m) G F AWset (get, E" , X.aop\ E n> , X.vis| E »*, Xar| E /»)}). 

All the shopping-cart operations on book remove every entry involving book from the 
items object before adding any entry on book to the same object. Also, the adding 
operation happens at the end of these operations, if it ever happens. Thus, 

{m | (book,m) G F AWset (get, Eq ,X.aop| s ^" , X.\j\%\ E m ,X.ar| B »/)} = {n}. 

From the same reason and the fact that / 0 is not (Xvis)-related to any event in E' 0 
that removes (book, n), it follows that / is not (N. vis) -related to any event in E' that 
operates on book. Because of these two observations, 

n = F cart (contains(&oofc), N"'.M) < F cart (contains(6oofc), N'.M). 

The only remaining part of our proof is to discharge the following claim: for all 
/ G N.E and nonnegative integers book, if we let 

E" = [N.v\s)-\f), E^ = p-\E"), N" = N\ E „, 
E"' = E"u{f}, Eq = /3~ 1 (£ ,/// ), and N"' = N\ E >», 

and 

F caxt (contains(book),N".M) = 

max({0}U{n | (book,n) G F Atfset (get, E'J, X.aop| E ^, X.v\s\ E >>, Xar| B »)}), 

(69) 

then 

f cart (contains(&oofc), N"'.M) = 

max({0}U{n | (book,n) G F AVset (get, E'J' , X.aop\ E <>, , X.\/\s\ E », , X.ar\ E »,)}). 

(70) 

Pick / G N.E and book. Define E", E'", E'q, N", N'" as described in our claim 
above. Also, assume that these data satisfy the equality in (69). We will prove the re- 
quired equality in (70) by the case analysis on N.aop(f). Since 

V/' G (N.E). (X.H)\ 0 - Hfl) G l{C 0 } oe0 }obj(N.aop(f),.) 

and I{C 0 } oe o] obj is defined only for the inc, dec and contains operations with 
nonnegative integer arguments, we only need to consider the following three cases of 
N.aop(f): 

N.aop(f) = inc ( book', n') V N.aop(f) = dec(book' , n') 

V N.aop(f) = contains (book 1 ) 

for some nonnegative integers book' and n' . 



- Assume that N.aop(f) = inc (book' , ri) for nonnegative integers book' and ri. If 
book 7^ froofc', 

f cart (contains(&oofc), A'".M) 
= -Fcart (contains(froofc), N".M) 

= max({0} U {n \ (book, n) G i^wset(get, Eq, A.aop| B » , X.vis| B » , Xar| B »)}) 
= max({0} U {n \ (book, n) G F AWset (get, Eft', X.aop\ E >>>, X.vis\ E ' 0 " , X.ar\ E m)}). 

The first equality comes from the definition of F cart and the fact that book' ^ book, 
and the second holds because of the assumption (69). The third holds because none 
of the events in Eq' — Eq is an inc or dec operation involving book. Assume now 
that book = book'. 

F cart (contains (book), N'" .M) 

= F cart (contains(6ooA;), N".M) + ri 

= max({0} U {n | (book, ri) G ^ AWs et(get, Eq, A.aop| E » , X.vis| B » , X.ar\ E »)}) + ri 

= max{n | (book, n) G F AWset (get, Eq' , X.aop\ E »,, X.v\s\ E m , X.ar\ E m)} 

= max({0} U {n \ (book, n) G F AWset (get, E'q , X.aop\ E »>, X.vis| B »- , X.ar| B »/)}). 

The first equality holds because N'" is the extension of N" with the A^"'. vis- 
maximum event / and the operation performed by / is inc ( book', ri) = 
inc ( book, ri). The second comes from the assumption (69). The third holds be- 
cause the implementation of the inc (book' , ri) operation removes all the elements 
involving book' from the items set and adds the following tuple to the set: 

(book' , 

max({0} U {n \ (book, n) G F AWset (get, Eq, Xaop| B », Xvis| B », Xar| B »)}) + ri). 
Furthermore, by the same reason, for every nonnegative integer n, 

(book,n) G F AWset (get, E'q" ,X.aop\ E >>> , X.\i\s\ E ,» ,X.ar\ E m) 

^=^> 

n = 

max({0} U {n \ (book, ri) G F AW set(get, Eq, X.aop| B », Xvis| B », Xar| B »)}) + ri. 

From this and the fact that ri > 0 follows the last equality in our derivation above. 

- Assume that N.aop(j) = dec(book' , ri) for nonnegative integers book' and ri. 
The overall structure of the proof of this case is similar to that of the previous one. 
If book ^ book', 

F cart (contains(6oofc), N'" .M) 
= F cart (contains(&oofc), N".M) 

= max ({0}U{n | (book,n) G F AWset (get, Eq , X.aop\ E ' o >, X.vis| £ », X.ar\ E />)}) 
= max ({0}U{n | (book,n) G F AWset (get, Eq' , Xaop| E /», X.v\s\ E m, X.ar\ E m)}). 



The reasons for all the equalities are identical to those used in the previous case. 
The first equality comes from the definition of F cart and the fact that book' ^ book, 
and the second from the assumption (69). The third holds because none of the 
events in E 0 " — E' 0 ' is an inc or dec operation involving book. Assume now that 
book = book'. 

F CSlTt (contains (book), N'" . M) 

= max{0, F cart (contains(6oofc), N".M)-n'} 

= max{0, max ({0} U 

{n | (book, n) G F AWset (get, Eq, X.aop\ E » , X.vis| E », X.ar\ E »)}) 

-n'} 

= max({0} U {n \ (book, n) e F kVset (get, Eq , X.aop\ E ^», X.vis\ E ' 0 " , X.ar\ E m)}). 

The first equality holds because N'" is the extension of A" with /, this / event is 
a maximum according to the A'". vis relation, and the operation performed by / is 
dec(book' , n') = dec(book, n'). The second comes from the assumption (69). Fi- 
nally, observe that the implementation of the ±n.c(book' , n') operation removes all 
the elements involving book = book' from the items object and adds the following 
tuple to the object: 

(book, 

max({0} U {n \ (book, n) G F AWset (get, E%, X.aop\ E > 0 ', X.v\s\ E n , X.ar| B »)}) - n') 

if the second component of the tuple is positive; otherwise, it does not add any 
tuple. The third equality follows from this observation. 
- Assume that N.aop(f) = contains(&oofc') for a nonnegative integer book'. If 
book 7^ book', 

F cart (contains(&oofc), N'" .M) 
= i 7 ' cart (contains(&oofc), N" .M) 

= max({0} U {n \ (book, n) e i^AWset(get, E' 0 \ A.aop| B » , XV\s\ E >< , X.ar\ E />)}) 
= max({0} U {n | (book, n) e i ? A wset(get, E' 0 " , X.aop\ E m ,XM\s\ E m , X.ar\ E »>)}). 

The reasons for all the equalities are identical to those used in the previous two 
cases. Assume now that book = book'. 

F cart (contains(&oofc), N'" .M) 
= ^cart (contains(6oofc), N" .M) 

= max({0} U {n | (book, n) € ^ AWset (get, Eq, A.aop| B » , X.vis| B » , Xar| B »)}) 
= max({0} U {n \ (book, n) G -F A wset(get, E' 0 ", X.aop\ E > o », X.\/\s\ E », , X.ar\ E ,»)}). 

The first equality holds because N'" is the extension of N" with /, this / event 
is maximum in N"'.E according to the A'". vis relation, and the operation per- 
formed by / is contains(6oofc') = contains(&oofc). The second comes from 
the assumption (69). The third equality holds because the implementation of the 



contains(6oofc') operation removes all the elements involving book = book' from 
the item,s object and adds the following tuple to the object: 



(book 



max({0}U{n| (book,n) e F AWset (get, S^', X.aop| B », Xvis| B », Xar| B »)})). 



E.3 An example of composing last-writer-wins objects 

We now illustrate that composing objects with last-writer-wins conflict-resolution poli- 
cies yields an object with the same policy. To this end, we use the primitive data type 
LWWreg of a last-writer-wins register. The data type has the signature {write, read} 
and its specification F Lmieg is defined as follows. We let F LW wre g ((write, a),M) = _L 
and let F LWtfreg ((read, _L), M) be defined if and only if M.ar is a total order on the set 
{e € M.E | M.aop(e) = (write, _)}; in this case F LWWreg returns the parameter of the 
last write event in this order, or _L if there are no such events. 

The following composite data type combines operations on a pair of last-writer- wins 
registers: 



This data type satisfies the specification F Pair that is analogous to F LWtfreg , but oper- 
ates on pairs of values: F Palr ((get, _L), M) returns the pair of values supplied as the 
parameter to the last write operation in the context according to M.ar, or _L if there 
are none; it is undefined if M.ar does not totally order write operations. We omit the 
trivial proof that F Pair is indeed the denotation of Dpair- 



□ 



-Dpair = let {x x 

read 



new LWWreg; x 2 = new LWWreg} in { 
atomic { xi.write(wi); a^.write^) }; 
atomic { Vout = (xi.read, £2. read) } } 



